Penetration Test Report (NCCGroup): NCC Group WhatsApp E001000M Report 2021 10 27 v1.2

End-to-End Encrypted Backups Security
Assessment
WhatsApp
October 27, 2021 – Version 1.2
Preparedby
GéraldDoussot
Marie-SarahLacharité
EricSchorn
©2021–NCCGroup
Prepared by NCC Group Security Services, Inc. for WhatsApp. Portions of this document and the
templates used in its production are the property of NCC Group and cannot be copied (in full or in
part)withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Table of Contents
1 TableofContents............................................................................ 2
2 ExecutiveSummary ......................................................................... 3
3 WhatsAppEncryptedBackupsSecretsManagementSolutionArchitecture ............. 6
4 GenericAttacksonOPAQUE ................................................................ 12
5 TrustedSetupCeremony.................................................................... 16
6 TableofFindings ............................................................................ 21
7 WhatsApp’sResponsetoNCCGroupFindings ............................................. 22
8 FindingFieldDefinitions .................................................................... 24
2 | WhatsAppEnd-to-EndEncryptedBackups WhatsApp/NCCGroup
Executive Summary
Synopsis
Duringthesummerof2021,WhatsAppengagedNCCGroup’sCryptographyServicesteamtoconductanindependent
security assessment of its End-to-End Encrypted Backups project. End-to-End Encrypted Backups is an hardware
securitymodule(HSM)basedkeyvaultsolutionthataimstoprimarilysupportencryptedbackupofWhatsAppuser
data. Thisassessmentwasperformedremotely,asa35person-dayeffortbythreeNCCGroupconsultantsoverthe
courseoffiveweeks. NCCGroupandtheWhatsAppteamscheduledtheretestingoffindings,andpreparationofthis
publicreportafewweekslater,followingthedeliveryoftheinitialsecurityassessment.
ProjectScopeandApproach
Thisassessmentwaspartofalargerprogramofwork,articulatedaroundfivephases:
• Phase1: End-to-EndEncryptedBackupsreview:
– Overallarchitecturereview,withafocusonthecryptographicimplementation.
• Phase2: “opaque-ke”open-sourcelibraryreview:
– Reviewoftheserver-sidecryptographicimplementationoftheOPAQUEprotocol.
• Phase3: HSMandkeymanagement:
– HSMconsensusprotocolreview.
– Keymanagementimplementationreview.
– Keyceremonyguidance.
• Phases4and5: Retestingandpublicreportcreation:
– Testingofanygapsfromearlierroundsoftesting,toensurecompletenessofcoverage.
– Retestingofanyrecommendedfixes,mitigations,orimprovements.
– Publicreports:
◦
End-to-EndEncryptedBackupsreport.
◦
“opaque-ke”report.
This public report discusses WhatsApp’s End-to-End Encrypted Backups only. The implementation of the server-
sideOPAQUEprotocolbythe“opaque-ke”librarywillbecoveredseparately. FortheEnd-to-EndEncryptedBackups
assessmentphases,NCCGroup’sevaluationincluded:
• End-to-EndEncryptedBackupsHSMSecureExecutionEnvironment(SEE):Embedded,customsecuritysoftware
thatrunswithinanHSM.
• End-to-EndEncryptedBackupsServer: ThriftservercolocatedonanHSMhost. TheserverconnectsSEEtothe
worldoutsidetheHSM.
• HSMcommonutilities: UsedbySEEandEnd-to-EndEncryptedBackupsserver.
• HSMconfiguration: HSMinitializationscripts.
• Chatd End-to-End Encrypted Backups module: Relay between external mobile clients and internal End-to-End
EncryptedBackupsServerendpoints.
• WA-MSYS:OPAQUEprotocolclientlibrary.
• WhatsAppiOSandAndroidClientsEnd-to-EndEncryptedBackupsinterface: MobileclientinterfacetoEnd-to-
EndEncryptedBackupsservice.
• Merkle library interface: Library used by End-to-End Encrypted Backups to protect data hosted on untrusted
storage.
TheconsultantsreviewedtheabovecomponentsstartingatfbsourcechangesetD28877521,whichincludedEnd-to-
EndEncryptedBackupsrelatedchangesetD28875781.
TheWhatsAppteamfurtherrequestedNCCGrouptoidentifyanygapsbetweentheEnd-to-EndEncryptedBackups
whitepaper1 technicalclaims,anditsactualimplementation,forthecomponentsinscopeattheendoftheproject.
NCCGroupdeliveredthisadditionalscopeitemaspartofphase5oftheprogramofwork.
1https://www.whatsapp.com/security/WhatsApp_Security_Encrypted_Backups_Whitepaper.pdf
3 | WhatsAppEnd-to-EndEncryptedBackups WhatsApp/NCCGroup
NCC Group assessed End-to-End Encrypted Backups for common cryptographic and software vulnerabilities using
mostlycodereview;theconsultantsperformedsomedynamictesting,leveragingexistingunittestcases.
Limitations
Thefollowingcomponentswerenotinscope; NCCGroupwasthereforeunabletoevaluateandidentifyissueswith
them:
• Third-partyandproprietaryHSMvendorimplementation.
• Backupencryptionimplementation.
• Side-channelsintheaccess,creation,modificationanddeletionofbackupdataonthird-partycloudstorage.
• End-to-EndEncryptedBackupsReverseProxy.
• OPAQUEsecurityprotocol.
Nevertheless,NCCGroupprovidedgoodtestcoverageofallthecomponentsinscopeforthisreview,aslistedinthe
previoussection,inthecontextoftheEnd-to-EndEncryptedBackupsservice.
KeyFindings
Theassessmentuncoveredanumberofcommoncryptographyandapplicationflaws.Themostnotablefindingswere:
• Weak 512 bits RSA key signing key, allowing attackers to impersonate the HSM and OPAQUE services, and to
decryptuserbackups.
• InsufficientvalidationofOPAQUEprotocoldata,thatmaypermitattackers,intheworstcase,torecoverauser’s
WhatsApppasswordandencryptedbackupinformation.
• Keymaterialinlowerintegrityenvironment,mayfacilitateacompletebypassoftheHSMandthusoftheEnd-to-
EndEncryptedBackupsservicesecurityassurancesthattheHSMprovides.
• Severalweaknessesinthehandlingofpasswords,whichmayallowanattackeringeneraltomoreeasilybrute-
forceuserpasswords.
• InsufficientaccesscontrolsfortheEnd-to-EndEncryptedBackupsservicefromtheinternalWhatsAppinfrastruc-
turemaypermitunauthorizedlargescaleoperationonuserdatasuchasaccountdeletion. Thisissuealsoresults
inanincreaseintheattacksurfaceoftheEnd-to-EndEncryptedBackupsserviceingeneral.
• Denialofserviceattackspotentialduetothelackofenforcementofcertainlimits.
NCC Group also compared the technical claims stated in the WhatsApp End-to-End Encrypted Backups whitepaper
version1.0withitsimplementationforthecomponentsinscopeforthisreview, andfoundnodiscrepanciesatthe
timeoftheassessment.
RetestSummary
TheWhatsAppteamimplementedanumberofchangestoaddressNCCGroup’sfindings. NCCGroupretestedthese
changesattheendofAugust2021. Duringtheassessment,NCCGroupidentified:
• one(1)highseverityvulnerability;
• nine(9)mediumseverityvulnerabilities;
• seven(7)lowseverityvulnerabilities;
• six(6)informationalfindings.
Upon completion of the assessment, all findings were reported to WhatsApp, along with recommendations. After
retesting, and before the solution was rolled out to users, fifteen findings were found to be fully fixed. There were
eightremainingfindings, whichNCCGroupreportedtoWhatsApp. WhatAppprovideddetailsaboutthesefindings
andtheirresponsetotheminWhatsApp’sResponsetoNCCGroupFindingsonpage22ofthisreport.
OtherRemarks
AllfindingsarelistedinTableofFindingsonpage21,alongwiththeirreteststatus. WhatsApp’sresponsetoseveral
findingscanbefoundinWhatsApp’sResponsetoNCCGroupFindingsonpage22. NCCGroupalsoprovidedahigh-
4 | WhatsAppEnd-to-EndEncryptedBackups WhatsApp/NCCGroup
level security evaluation of the End-to-End Encrypted Backups architecture design in WhatsApp Encrypted Backups
SecretsManagementSolutionArchitectureonthenextpageincludingkeydesignsecurityassumptions,andrecom-
mendationsforestablishingandmanagingkeyceremoniesinTrustedSetupCeremonyonpage16. Aninteresting
attack,generalizabletoanyconsumersoftheOPAQUEprotocol,wasdescribedinsomedetailsinGenericAttackson
OPAQUEonpage12. Findingdetailsandotherinformationalsectionswereomittedfromthepublicdocument. Note
thatmissingfindingnumbersinTableofFindingsonpage21areanartefactofNCCGroup’sinternalreportingtools
anddonotimplymissingfind