End-to-end encryption is becoming increasingly prevalent in contemporary communications, particularly the Signal protocol that is used in popular apps like WhatsApp. However, there remain some methods of attacking these communications.
Man-in-the-middle
One such attack is known as ‘man-in-the-middle’ – when an attacker is able to intercept messages by pretending to be the intended recipient’s device. This can bypass the encryption using forged keys. Our researchers, working with colleagues in Luxembourg and Oxford, have developed a new protocol that prevents this type of attack. The (Detecting Endpoint Compromise in Messaging (DECIM) protocol introduces a secure ledger that is used to store certified encryption keys and their use, thereby forcing attackers to leave evidence of their presence.
‘Our Security and Privacy group tries to solve problems that are important to society,’ explains Professor Mark Ryan, of the School of Computer Science. ‘Given the prevalence of cyber-attacks on phones and laptops, we are proud of this work on detecting when encryption keys have become compromised.’
High risk
The importance of secure end-to-end encryption is nowhere more apparent than for journalists and activists who may need to be sure that their communications are private when operating in unstable areas of the world or on issues that might attract unwanted attention. Such individuals are at a high risk of their phones and devices being targeted.
The new DECIM protocol ensures that should their secure communication channels be compromised by man in the middle attacks, the victims will be made aware of the breach and can take measures to protect themselves both digitally and in the real world. For those championing rights and peace, and exposing corruption and injustice, it is increasingly important to know that their work does not put the individuals involved in any more danger than is necessary.
Visit the Human Rights Watch website for more information about the United Nations’ position on how encryption protects people’s rights.