How does WhatsApp's end‑to‑end encryption work under the hood?

10 Eki 23:26

WhatsApp’s crypto is basically a thin wrapper around the Signal Protocol. When you first install the app it creates a long‑term identity key pair (Curve25519) that never changes unless you explicitly reset it. Alongside that it generates a set of one‑time pre‑keys and a signed pre‑key, all stored on WhatsApp’s key‑distribution server (the server never sees the private parts). When you start a chat, the initiator fetches the recipient’s identity key, signed pre‑key and a handful of one‑time pre‑keys. Using the X3DH (Extended Triple Diffie‑Hellman) handshake it combines its own ephemeral key with those three remote keys to derive a shared secret. That secret seeds the Double Ratchet: a symmetric‑key ratchet for message keys and an asymmetric ratchet for future DH exchanges. Every message encrypts with a fresh AES‑256‑GCM key derived from the ratchet, which gives forward secrecy—compromise of a current key can’t decrypt past traffic because previous keys are already discarded. Key rotation is baked into the protocol. After a certain number of messages (or time‑based triggers) the Double Ratchet generates a new DH key pair and performs a “DH step”, which updates the root key and discards the old chain keys. If you reinstall WhatsApp or switch devices, the old identity key is considered revoked; the app generates a fresh identity key pair and a new batch of pre‑keys, which are uploaded to the server. Contacts will see a “new device” event and a fresh X3DH handshake will run the next time you message them, establishing a new session without any manual key exchange. For a deeper dive, check the Signal Protocol whitepaper (the “double ratchet” section) and the “Signal Android” source – the WhatsApp client is a fork, so the code paths are almost identical. The combination of X3DH for initial key agreement and the Double Ratchet for per‑message keys is what gives WhatsApp its claimed forward secrecy and post‑compromise security.