Prekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866913894846431232 |
|---|---|
| author | Gegenhuber, Gabriel K. Frenzel, Philipp É. Günther, Maximilian Judmayer, Aljosha |
| author_facet | Gegenhuber, Gabriel K. Frenzel, Philipp É. Günther, Maximilian Judmayer, Aljosha |
| contents | WhatsApp, the world's largest messaging application, uses a version of the Signal protocol to provide end-to-end encryption (E2EE) with strong security guarantees, including Perfect Forward Secrecy (PFS). To ensure PFS right from the start of a new conversation -- even when the recipient is offline -- a stash of ephemeral (one-time) prekeys must be stored on a server. While the critical role of these one-time prekeys in achieving PFS has been outlined in the Signal specification, we are the first to demonstrate a targeted depletion attack against them on individual WhatsApp user devices. Our findings not only reveal an attack that can degrade PFS for certain messages, but also expose inherent privacy risks and serious availability implications arising from the refilling and distribution procedure essential for this security mechanism. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2504_07323 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Prekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism Gegenhuber, Gabriel K. Frenzel, Philipp É. Günther, Maximilian Judmayer, Aljosha Cryptography and Security Networking and Internet Architecture WhatsApp, the world's largest messaging application, uses a version of the Signal protocol to provide end-to-end encryption (E2EE) with strong security guarantees, including Perfect Forward Secrecy (PFS). To ensure PFS right from the start of a new conversation -- even when the recipient is offline -- a stash of ephemeral (one-time) prekeys must be stored on a server. While the critical role of these one-time prekeys in achieving PFS has been outlined in the Signal specification, we are the first to demonstrate a targeted depletion attack against them on individual WhatsApp user devices. Our findings not only reveal an attack that can degrade PFS for certain messages, but also expose inherent privacy risks and serious availability implications arising from the refilling and distribution procedure essential for this security mechanism. |
| title | Prekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2504.07323 |