Why you should use end-to-end encryption

I recently added end-to-end encryption to my app, Neucards. It's a really important safeguard, so here is a quick explanation of what it is and why you need it.

What is end-to-end encryption?

When you send information to someone else, oftentimes, it is sent in a clear, readable form, meaning you or anyone could look at the information and understand the contents easily. Opportunities for others to peak at your information come when it is sent over a network or stored on a server. End-to-end encryption jumbles your information so that it is no longer understandable before it leaves your device and it can only be un-jumbled by the intended recipient on their device.

How does end-to-end encryption work?

The jumbling and un-jumbling of information is done using encrypt and decrypt functions plus a key. Keys are sometime as simple as a password or they can be incredibly large random numbers. The more difficult a key is to guess or obtain increases the security of your information. An encrypt function takes your clear information and a key to produce a cipher text, which looks like random characters. Similarly, a decrypt function takes a cipher text and the same key to produce the original clear information. Since both the encrypt and decrypt functions use the same key, they are called symmetric encryption.

symmetric encryption

encrypt("secret message", "password")
returns "98fh38f7h238je9h28ry3d"

decrypt("98fh38f7h238je9h28ry3d", "password")
returns "secret message"

The problem is that you and someone else must agree on a shared key before you can exchange information securely and sending them the key insecurely defeats the purpose. To escape this conundrum, we will use public/private key pairs that are created to work in concert with each other.

A public key is available to anyone and may be stored on a server to be given to other people freely. The private key is only stored on a person's device and should stay protected. Combining your private key with another person's public key produces a shared key, which can be used to encrypt your information, like in the above example, before sending it to your server or to the other person. Only the other person's private key and your public key can be combined to produce the same shared key, so only they have the ability to decrypt your information. Because this process uses multiple keys, it is called asymmetric encryption.

asymmetric encryption

On your device

encrypt("secret message", theirPublicKey, yourPrivateKey)
returns "sdckjhiuw7t3hwiu8we"

On their device

decrypt("sdckjhiuw7t3hwiu8we", yourPublicKey, theirPrivateKey)
returns "secret message"

End-to-end encryption uses public/private key pairs to protect your information from everyone except those you want to have access.

Do I need to adopt end-to-end encryption as a developer?

End-to-end encryption is meant to exchange information from one person to another person privately. Anytime you are dealing with chat messages, contact details, photos, or other potentially sensitive types of information, you should consider adding it. But, be forewarned that this is a very complex feature and you should follow proven examples of how to do it. One of the best groups for this is LibSodium.

Who is doing end-to-end encryption?

WhatsApp by Meta is making a big push and has even made a commercial explaining the concern.

Other major companies doing end-to-end encryption:

• Signal
• Apple
• Zoom*
• Telegram*
• Neucards :)

\* add on feature not enabled by default

Let me know if you have any questions! If you'd like more details, I'd be happy to do a follow up post.