Article
E2E encryption - What is it
What is end-to-end encryption? We hear about it often, but how does it work? Today we take a brief look at one of the most important technologies of our century.
In this article
End-to-end encryption: what it is and how it works
End-to-end encryption (E2EE) is a system that makes data unrecognisable on the sender's device and decrypts it only on the recipient's, preventing any intermediary — server, ISP or service provider — from accessing the content.
Cryptographic foundation
The mechanism is based on asymmetric cryptography: each user generates a key pair, a public key that is shared and a private key that is kept exclusively on the device. The sender encrypts the message with the recipient's public key, and only the corresponding private key can decrypt it, ensuring that not even the server the data passes through can read it.
The Double Ratchet: the Signal case
Modern protocols (Signal, WhatsApp) implement the Double Ratchet Algorithm, which combines a Diffie-Hellman ratchet with two symmetric ratchets, one for the sending chain and one for the receiving chain. With every message exchanged, new ephemeral keys are derived through key derivation functions, so that the compromise of one key exposes neither previous messages (forward secrecy) nor future ones (post-compromise security). The encryption operation uses AEAD (Authenticated Encryption with Associated Data): a MAC is computed on the sending chain and verified on receipt before proceeding to decrypt, guaranteeing integrity and authenticity as well as confidentiality.
Key management in practice
In the real implementation, the secret key is generated locally on both devices, is never shared with the server and is regenerated with every message, then deleted after use. Each E2EE session also exposes a unique verification code (fingerprint) that makes it possible to authenticate the identity of the other party out of band and detect possible man-in-the-middle attacks.
What it protects and what it doesn't
E2EE guarantees the confidentiality of the content in transit and at rest on intermediate servers, but it does not automatically protect metadata such as sender, recipient, time and size of the message. Security also depends on the integrity of the endpoints: if a device is compromised by malware, end-to-end encryption does not prevent the exfiltration of data that has already been decrypted.
Comments
To comment log in or create an account.