What exactly is end-to-end encryption?

Every smartphone user may receive hundreds of text messages every week. Social media services also maintain user engagement by pushing dozens of direct messages every day. Worldwide, messaging apps like WhatsApp process over 100 billion messages per day. But are these pieces of information really private?

This is the purpose of end-to-end encryption. In practice, it ensures that only the sender and receiver can access the data. In addition, when transmitting data, Internet service providers (ISPs), application service providers, hackers or any other entities or services cannot read or tamper with the data.

Many companies and platforms are now promoting end-to-end encryption as a core security and privacy feature. It is not only used for information transmission and social media. Many online shopping websites use end-to-end encryption to ensure the security of payment data. But consumers are often unfamiliar with the role of end-to-end encryption and how it protects ordinary people. Therefore, we have compiled some common questions about this privacy technology.

Kayne McGladrey, a senior member of IEEE, said: "End to end encryption is usually considered a useful technology to protect the data of enterprises and consumers. For example, if the payment information of consumers is easy to be intercepted, online shopping will not be so popular or feasible. Similarly, if someone can see the private video calls made by executives or government officials through the Internet, then this will also be a huge risk."

End to end encryption is not universal or enabled by default in all services. Some messaging services and social media applications do not use end-to-end encryption. Although some messaging services automatically enable encryption, other services still require users to manually enable it. In the past few years, although this process has become easier, there are still obstacles. As stated by the authors of the new IEEE Security and Privacy journal, "every step required for a security mechanism has the potential to reduce the number of users willing to use it." Users should review the terms of service of their messaging application or social media account to understand the level of privacy protection provided by the service.

Behind the rise of end-to-end encryption is the gradual lowering of technological barriers. Until a few years ago, the application of end-to-end encryption still posed significant challenges for ordinary consumers. A study found that these old forms of encryption have usability issues, and most users make catastrophic mistakes when using them. McGladrey said, "Simply put, end-to-end encryption involves using public key encryption, where both the sender and receiver generate a pair of encryption keys consisting of a public key and a private key. Although this process was technically difficult and time-consuming to implement in the past, technological advancements over the past 20 years can help users use it more conveniently and smoothly

But end-to-end encryption cannot protect everything. IEEE Senior Member Kevin Curran said, "It should be noted that although end-to-end encryption can protect communication content, it cannot protect other metadata such as sender and receiver information or message timestamps." This means that although a spy may not know what two people are talking about, they can know that they are communicating, and from the frequency of communication, it can also be inferred that communication is important.

There are also pitfalls to using end-to-end encryption. McGladrey said, "A key factor is that the key usually only exists on the device. Although this means that threat actors, service providers, or government entities cannot read encrypted data, it also means that losing a device with the key will functionally prevent one party from accessing the data

End to end encryption is not the same as other forms of encryption. IEEE Lifetime Senior Member Raul Colcher said, "End to end encryption is different from other forms of encryption such as TLS (Transport Layer Security) and SSL (Secure Sockets Layer). They serve different purposes and operate at different communication layers. End to end encryption focuses on protecting the content of the communication itself, while TLS and SSL protect the communication channel between the client and server. ”

Regarding the current status and future of end-to-end encryption, Curran said, "End to end encryption may pose challenges for law enforcement agencies to investigate criminal activities. Balancing privacy and security with legitimate access requirements remains a ongoing debate in the context of end-to-end encryption. However, end-to-end encryption is a powerful technology that can protect consumer data and ensure confidentiality, privacy, and data integrity throughout the entire communication process." He added, "Governments and regulatory agencies will continue to shape the future of end-to-end encryption through policy decisions and legal frameworks. Balancing privacy, legitimate access, and public safety considerations will be key to shaping the regulatory landscape