What Is End-To-End Encryption?

End-to-end encryption is considered the most secure way to transfer data online. More and more users and services are turning to it. What is it exactly? And how does it work?

What is end-to-end encryption?

End-to-end encryption, or E2EE is a method of secure communication within communication software in which messages are encrypted in a way that they can only be read by the users at either end, and not anyone in between. It’s built into various digital platforms and services, including messaging apps, to protect exchanges of user data.

End-to-end encryption or E2EE applies only in a context where you are communicating with a third party (a friend, for example) using a web site or smartphone app. When you are buying something from a site or posting on a social media platform, you only need to make sure that your communication is over HTTPS. That way, only the site can see what you are sending it.

To encrypt data—like text messages or emails—is to scramble it in such a way that it can only be read by a person with a decryption key. Encryption protects information transmitted online by turning plain text into an unreadable format called ciphertext.

With end-to-end encryption, only the sender and the recipient’s devices hold the decryption keys, known as cryptographic keys. Messages and files are encrypted before they leave the origin device and aren’t decrypted until they reach their destination.

Why is end-to-end encryption important?

End-to-end encryption ensures that no one can access or alter the contents of a message while it’s in transit. No third-party eavesdropper—not the messaging service, nor the internet service provider (ISP), nor a hacker—can access the cryptographic keys needed to decipher the encrypted message. With E2EE, service providers act as illiterate messengers, passing along messages they can’t themselves decode.

End-to-end encryption is particularly important where data security is a priority, such as in healthcare, communications, and finance sectors. Point-of-sale (POS) service providers, for instance, use E2EE to protect sensitive data, like credit card information.

But more and more ordinary users are choosing end-to-end encrypted products, especially as trust in big tech companies declines. E2EE gained traction in 2013 after Edward Snowden, a former NSA contractor, leaked data showing the extent to which the NSA and other intelligence and law enforcement agencies were accessing ordinary citizens’ communications without their knowledge.

Cybersecurity is now a growing concern with more people working from home since the start of the pandemic. Case in point: Zoom faced intense criticism last spring after alleging that its video calling service was end-to-end encrypted when it in fact wasn’t. Zoom responded by hiring cryptography consultants and buying up Keybase, a company specializing in E2EE. By the fall Zoom was secure, end to end. The NSA recently issued guidelines encouraging the use of E2EE when working and convening remotely.

Applications that use end-to-end encryption

Pretty Good Privacy (PGP) was the first free, widely adopted end-to-end encrypted messaging software. Coded by Phil Zimmermann and released in 1991, it secured email as well as stored files and digital signatures. It’s taken decades for the technology to reach its current zenith.

Here are a few popular apps that use end-to-end encryption as of August 2021:

• Apple's iMessage
• Facebook Messenger (not by default)
• Google Allo (not by default)
• Google Duo
• Jabber
• Signal
• Square
• Telegram (not by default)
• WhatsApp
• Wicker
• Zoom

How end-to-end encryption works

With end-to-end encryption, the cryptographic keys needed to decrypt the data are stored on the endpoint devices. This is possible thanks to an encryption system called public key encryption, sometimes referred to as asymmetric encryption or asymmetric cryptography.

A program on your device generates a pair of cryptographic keys; a public key and a private key:

• Your public key is shared with anyone who wants to send you data, like a message, and its design ensures that the data can only be decrypted with the corresponding private key. Public keys are widely known and distributed to guarantee their legitimacy.
• Your private key, or secret key, decrypts the data you receive and never leaves your device.

In other words, anyone with your public key can send you data, but only you hold the private key to decipher it. This can be likened to a locked mailbox on your doorstep: your postal service holds the ‘public key’ to deliver the mail, but only you hold the ‘private key’ needed to unlock the box and read your letters.

How does end-to-end encryption differ from other types of encryption?

In most online communications, the data exchanged between user endpoints passes through the service provider’s server. When a service is not end-to-end encrypted, the provider holds copies of the decryption keys and can access user data on its server. These services can therefore only guarantee private communication between user endpoints and the intermediate server, and not the entire length of the transmission from user to user.

Encryption-in-transit

Encryption-in-transit, for example, is a more common form of encryption whereby data is decrypted and re-encrypted during transmission. Data is first encrypted on the sender’s end, decrypted and stored on the service provider’s server, then re-encrypted, and decrypted again on the receiving end. The information is unreadable between these points, but this isn’t considered E2EE because the data is decoded before reaching the final recipient.

Encryption-in-transit creates vulnerabilities by design. The data, stored on the service provider’s server, is safe from unauthorized users, but since the service provider holds a copy of decryption keys, there's nothing stopping the service provider—or anyone with access to the server—from accessing the information.

In some cases, this type of encryption also allows the service provider to read user data in order to, say, serve them targeted ads. This also means that the data can be scanned for illegal content. With a warrant, law enforcement and intelligence agencies can access this data through the service provider without having to go through the user endpoints.

Symmetric key encryption

End-to-end encryption also differs from symmetric key encryption, also known as single-key or secret key encryption.

Like E2EE, only the sender and the receiver can decrypt and read the messages, providing an unbroken layer of protection between endpoints. But unlike E2EE, symmetric key encryption only uses a single key to cipher and decipher the data.

With symmetric key encryption, the single key needs to be exchanged between endpoints. This leaves open the possibility that the decryption key can be intercepted, and an intermediary can get ahold of it. The same can’t be said about E2EE, which, thanks to public encryption, i.e. asymmetric encryption, uses two different keys. This keeps intermediaries from accessing the keys and, thereby, the data.

Advantages of using end-to-end encryption

• Protected contents. Your end-to-end encrypted data can’t be accessed in transit, where it might otherwise be decrypted as it passes through your service provider’s server. When your service provider holds copies of your data’s decryption keys, so does anyone with access to its server, including hackers. E2EE makes sure that any attack that targets your provider’s server won’t result in a breach of your data. No private keys, no access.
• No tampering. End-to-end encrypted data can’t be altered; that is, the contents of a message or a file, like a photo, can’t be changed. If your message—encrypted with a public key—is tampered with in transit, it can no longer be decoded with the recipient’s corresponding private key, rendering the content inaccessible. Receiving a successfully decrypted message means it wasn’t altered in transit.

Disadvantages of using end-to-end encryption

You might be under the impression that end-to-end encryption is the quick fix to any data transfer problem. But E2EE isn’t impervious to snooping. Here are some of its limitations:

• Visible metadata. While end-to-end encryption protects the contents of your message, some information about the message—including the date and time it was sent and the users involved in the exchange—is still accessible. In other words, although the data is impossible to read, it still carries clues about the context of the exchange. This information can be useful to an eavesdropper looking to access the unencrypted data once delivered.
• Compromised endpoints. Even with perfect end-to-end encryption, there are still two vulnerable points: the ends. The line of communication is only as secure as the devices on either side. If an attacker gains access to either endpoint device they can read messages before they’re encrypted or once they’ve been decrypted, and can even impersonate a user. Malware on your smartphone, for example, can read your correspondence. Protecting device and application access—even with just a PIN code—can go a long way.
  • Compromised endpoints can also make your data vulnerable to man-in-the-middle (MITM) attacks. Instead of trying to break the encryption, an attacker can impersonate a recipient so that messages are encrypted to their public key rather than that of the intended recipient. After decrypting the message, the attacker can re-encrypt it with the original public key, and pass the data on to the intended recipient to avoid detection.

While not necessarily a disadvantage, it’s worth mentioning that E2EE isn’t future-proof. It’s currently the most secure way to transfer data online. but this might not always be the case. Some speculate that quantum computing will make cryptography obsolete. In other words, you may not always be able to rely on end-to-end encryption to keep your data safe.

Too much privacy?

One of the critiques of end-to-end encryption is that it allows too much privacy.

In 2016, the FBI tried to compel Apple to unlock the iPhone of one of the attackers in the 2015 San Bernardino mass shooting with an order to effectively decrypt its own product in order to give access to the attacker’s encrypted communications. Tim Cook, Apple’s chief, refused to comply, saying the request would open the door to more invasive government interception down the line.

The incident set off a furious public battle over end-to-end encryption and the limits of online privacy.

Law enforcement, intelligence agencies, and governments tend to argue that end-to-end encryption makes it harder to keep tabs on illicit activities—such as child abuse, human trafficking, or terrorism—leading some to complain about data “going dark.” Since EE2E makes it impossible for providers to read the messages passing through their servers, it makes it increasingly difficult to detect the transmission of harmful content.

On the other hand, privacy advocates, human rights activists, and technologists tend to agree that people should be able to communicate online without anyone eavesdropping on their conversations, and that end-to-end encryption helps shield ordinary citizens from government overreach and mass surveillance—particularly at a time digital communication platforms are essential for nearly everything, from organizing protests to attending medical appointments.

The best way to limit how much tech companies know about you is to use privacy-protecting alternatives, like Neeva. Neeva is the world’s first private, ads free search engine, committed to showing you the best results for every search. We will never sell or share your data with anyone, especially advertisers. Try Neeva for yourself, at neeva.com.