More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema
Rösler P, Mainka C, Schwenk J (2018)
Publication Type: Conference contribution
Publication year: 2018
Publisher: Institute of Electrical and Electronics Engineers Inc.
Pages Range: 415-429
Conference Proceedings Title: Proceedings - 3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018
Event location: London
ISBN: 9781538642276
DOI: 10.1109/EuroSP.2018.00036
Abstract
Secure instant messaging is utilized in two variants: one-to-one communication and group communication. While the first variant has received much attention lately (Frosch et al., EuroS Cohn-Gordon et al., EuroS Kobeissi et al., EuroS&P17), little is known about the cryptographic mechanisms and security guarantees of secure group communication in instant messaging. To approach an investigation of group instant messaging protocols, we first provide a comprehensive and realistic security model. This model combines security and reliability goals from various related literature to capture relevant properties for communication in dynamic groups. Thereby the definitions consider their satisfiability with respect to the instant delivery of messages. To show its applicability, we analyze three widely used real-world protocols: Signal, WhatsApp, and Threema. By applying our model, we reveal several shortcomings with respect to the security definition. Therefore we propose generic countermeasures to enhance the protocols regarding the required security and reliability goals. Our systematic analysis reveals that (1) the communications' integrity - represented by the integrity of all exchanged messages - and (2) the groups' closeness - represented by the members' ability of managing the group - are not end-to-end protected. We additionally show that strong security properties, such as Future Secrecy which is a core part of the one-to-one communication in the Signal protocol, do not hold for its group communication.
Authors with CRIS profile
Involved external institutions
Germany (DE)How to cite
APA:
Rösler, P., Mainka, C., & Schwenk, J. (2018). More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema. In Proceedings - 3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018 (pp. 415-429). London, GB: Institute of Electrical and Electronics Engineers Inc..
MLA:
Rösler, Paul, Christian Mainka, and Joerg Schwenk. "More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema." Proceedings of the 3rd IEEE European Symposium on Security and Privacy, EURO S and P 2018, London Institute of Electrical and Electronics Engineers Inc., 2018. 415-429.
BibTeX: Download