How WhatsApp is enabling end-to-end encrypted backups
Sep 10, 2021Slavik Krassovsky, Gabriel Cadden
Summary
This post introduces end-to-end encryption (E2EE) for WhatsApp backups, a significant enhancement to application security and privacy. It details the technical implementation, including the generation of unique encryption keys, the use of a password-protected Backup Key Vault built on hardware security modules (HSMs) for secure key storage and retrieval, and the encryption of backup data using symmetric encryption. The system is designed for high availability and reliability, with geographically distributed HSMs to prevent data loss during outages. The client-server authentication protocol and the role of the ChatD service in handling client connections are also described.
More from the Application Security and Permissions trail
- How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees
- Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study
- Labyrinth 1.1: Making End-to-End Encrypted Backups Even More Reliable
- How Meta Is Strengthening End-to-End Encrypted Backups
- Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways