On the End-to-End Security of Group Chats in Instant Messaging Protocols

Secure instant messaging is utilized in two variants: one-to-one communication and group communication. While the first variant has received much attention lately (Frosch et al., EuroS&P16; Cohn-Gordon et al., EuroS&P17; Kobeissi et al., EuroS&P17), little is known about the cryptographic mechanisms and security guarantees of secure group communication in instant messaging. In this thesis, we investigate group communication security mechanisms of three major massaging applications: Signal, WhatsApp, and Threema. We first introduce the scientific background of theoretical and practical approaches to define and analyze secure group instant messaging. Then this thesis mainly consists of the results, the author (together with Mainka and Schwenk) published as the article “More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema” in the proceedings of 3rd IEEE European Symposium on Security and Privacy (Euro S&P 2018). To approach an investigation of group instant messaging protocols in this publication, we provide a comprehensive and realistic attacker model. This model combines security and reliability goals from various related literature to capture relevant properties for communication in dynamic groups. Thereby we also consider the satisfiability of the definitions with respect to the instant delivery of messages. Since the analyzed protocols and their implementations are mostly undocumented for the public and two out of three applications among them are closed source, we are the first to describe the group protocols employed in Signal, WhatsApp, and Threema. By applying our model on these protocols, we reveal several shortcomings with respect to our security definition. Therefore we propose generic countermeasures to enhance the protocols regarding the required security and reliability goals. Our systematic analysis reveals that 1. the communications’ integrity – represented by the integrity of all exchanged messages – and 2. the groups’ closeness – represented by the members’ ability of managing the group – are not end-to-end protected. We additionally show that strong security properties, such as Future Secrecy which is a core part of the one-to-one communication in the Signal protocol, do not hold for group communication. Official Declaration Hereby I declare, that I have not submitted this thesis in this or similar form to any other examination at the Ruhr-Universität Bochum or any other Institution of High School. I officially ensure, that this paper has been written solely on my own. I herewith officially ensure, that I have not used any other sources but those stated by me. Any and every parts of the text which constitute quotes in original wording or in its essence have been explicitly referred by me by using official marking and proper quotation. This is also valid for used drafts, pictures and similar formats. I also officially ensure, that the printed version as submitted by me fully confirms with my digital version. I agree that the digital version will be used to subject the paper to plagiarism examination. Not this English translation, but only the official version in German is legally binding. Eidesstattliche Erklärung Ich erkläre, dass ich keine Arbeit in gleicher oder ähnlicher Fassung bereits für eine andere Prüfung an der Ruhr-Universität Bochum oder einer anderen Hochschule eingereicht habe. Ich versichere, dass ich diese Arbeit selbstständig verfasst und keine anderen als die angegebenen Quellen benutzt habe. Die Stellen, die anderen Quellen dem Wortlaut oder dem Sinn nach entnommen sind, habe ich unter Angabe der Quellen kenntlich gemacht. Dies gilt sinngemäß auch für verwendete Zeichnungen, Skizzen, bildliche Darstellungen und dergleichen. Ich versichere auch, dass die von mir eingereichte schriftliche Version mit der digitalen Version übereinstimmt. Ich erkläre mich damit einverstanden, dass die digitale Version dieser Arbeit zwecks Plagiatsprüfung verwendet wird.