CINXE.COM

<!DOCTYPE html> <html lang="en-US"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-title" content="Engineering at Meta - Engineering at Meta Blog"> <meta property="fb:app_id" content="1425766027653270" /> <link rel="profile" href="http://gmpg.org/xfn/11"> <link rel="pingback" href="https://engineering.fb.com/xmlrpc.php"> <meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /> <style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style> <script async src="https://engineering.fb.com/wp-content/themes/code-fb-com/dist/js/optimize.min.js"></script>  <title>Deploying key transparency at WhatsApp - Engineering at Meta</title> <meta name="description" content="With key transparency, WhatsApp provides a set of proofs that affirms the correctness of public encryption keys." /> <link rel="canonical" href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/" /> <meta name="twitter:label1" content="Written by" /> <meta name="twitter:data1" content="Sean Lawlor, Kevin Lewi" /> <meta name="twitter:label2" content="Est. reading time" /> <meta name="twitter:data2" content="10 minutes" /> <script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Article","@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#article","isPartOf":{"@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/"},"author":[{"@id":"https://engineering.fb.com/#/schema/person/image/7a7bcff202132a2d5225853cbda03ec1"},{"@id":"https://engineering.fb.com/#/schema/person/image/69237e68805ba201b952ae7a59239988"}],"headline":"Deploying key transparency at WhatsApp","datePublished":"2023-04-13T12:59:32+00:00","dateModified":"2023-10-19T16:19:51+00:00","mainEntityOfPage":{"@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/"},"wordCount":2032,"publisher":{"@id":"https://engineering.fb.com/#organization"},"image":{"@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#primaryimage"},"thumbnailUrl":"https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg","keywords":["WhatsApp"],"articleSection":["Android","iOS","Open Source","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/","url":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/","name":"Deploying key transparency at WhatsApp - Engineering at Meta","isPartOf":{"@id":"https://engineering.fb.com/#website"},"primaryImageOfPage":{"@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#primaryimage"},"image":{"@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#primaryimage"},"thumbnailUrl":"https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg","datePublished":"2023-04-13T12:59:32+00:00","dateModified":"2023-10-19T16:19:51+00:00","description":"With key transparency, WhatsApp provides a set of proofs that affirms the correctness of public encryption keys.","breadcrumb":{"@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#primaryimage","url":"https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg","contentUrl":"https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://engineering.fb.com/"},{"@type":"ListItem","position":2,"name":"Deploying key transparency at WhatsApp"}]},{"@type":"WebSite","@id":"https://engineering.fb.com/#website","url":"https://engineering.fb.com/","name":"Engineering at Meta","description":"Engineering at Meta Blog","publisher":{"@id":"https://engineering.fb.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://engineering.fb.com/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https://engineering.fb.com/#organization","name":"Meta","url":"https://engineering.fb.com/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/#/schema/logo/image/","url":"https://engineering.fb.com/wp-content/uploads/2023/08/Meta_lockup_positive-primary_RGB.jpg","contentUrl":"https://engineering.fb.com/wp-content/uploads/2023/08/Meta_lockup_positive-primary_RGB.jpg","width":29011,"height":12501,"caption":"Meta"},"image":{"@id":"https://engineering.fb.com/#/schema/logo/image/"},"sameAs":["https://www.facebook.com/Engineering/","https://twitter.com/fb_engineering"]},[],{"@type":"Person","@id":"https://engineering.fb.com/#/schema/person/image/7a7bcff202132a2d5225853cbda03ec1","name":"Sean Lawlor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/#/schema/person/image/23494c9101089ad44ae88ce9d2f56aac","url":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","caption":"Sean Lawlor"},"url":"https://engineering.fb.com/author/sean-lawlor/"},{"@type":"Person","@id":"https://engineering.fb.com/#/schema/person/image/69237e68805ba201b952ae7a59239988","name":"Kevin Lewi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://engineering.fb.com/#/schema/person/image/23494c9101089ad44ae88ce9d2f56aac","url":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/?s=96&d=mm&r=g","caption":"Kevin Lewi"},"sameAs":["https://klewi.com/"],"url":"https://engineering.fb.com/author/kevin-lewi/"}]}</script>  <link rel='dns-prefetch' href='//secure.gravatar.com' /> <link rel='dns-prefetch' href='//v0.wordpress.com' /> <link rel="alternate" type="application/rss+xml" title="Engineering at Meta » Feed" href="https://engineering.fb.com/feed/" /> <link rel="alternate" type="application/rss+xml" title="Engineering at Meta » Comments Feed" href="https://engineering.fb.com/comments/feed/" /> <script async src="https://www.googleoptimize.com/optimize.js?id=OPT-TPNDQC5" onerror="dataLayer.hide.end && dataLayer.hide.end()"></script> <script type="text/javascript"> /* <![CDATA[ */ window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/engineering.fb.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.2"}}; /*! This file is auto-generated */ !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); /* ]]> */ </script> <style id='wp-emoji-styles-inline-css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='all-css-2' href='https://engineering.fb.com/wp-includes/css/dist/block-library/style.min.css?m=1739294329g' type='text/css' media='all' /> <link rel='stylesheet' id='all-css-4' href='https://engineering.fb.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWz01NyUxMzUnNTc0rQeEU5CRWphbp5qSmJyZX6uVm5uklFxfr6OPTDpRD5sM02efaGpobWxpZmhgbGwAAROEu5A==' type='text/css' media='all' /> <style id='jetpack-sharing-buttons-style-inline-css'> .jetpack-sharing-buttons__services-list{display:flex;flex-direction:row;flex-wrap:wrap;gap:0;list-style-type:none;margin:5px;padding:0}.jetpack-sharing-buttons__services-list.has-small-icon-size{font-size:12px}.jetpack-sharing-buttons__services-list.has-normal-icon-size{font-size:16px}.jetpack-sharing-buttons__services-list.has-large-icon-size{font-size:24px}.jetpack-sharing-buttons__services-list.has-huge-icon-size{font-size:36px}@media print{.jetpack-sharing-buttons__services-list{display:none!important}}.editor-styles-wrapper .wp-block-jetpack-sharing-buttons{gap:0;padding-inline-start:0}ul.jetpack-sharing-buttons__services-list.has-background{padding:1.25em 2.375em} </style> <style id='elasticpress-facet-style-inline-css'> .widget_ep-facet input[type=search],.wp-block-elasticpress-facet input[type=search]{margin-bottom:1rem}.widget_ep-facet .searchable .inner,.wp-block-elasticpress-facet .searchable .inner{max-height:20em;overflow:scroll}.widget_ep-facet .term.hide,.wp-block-elasticpress-facet .term.hide{display:none}.widget_ep-facet .empty-term,.wp-block-elasticpress-facet .empty-term{opacity:.5;position:relative}.widget_ep-facet .empty-term:after,.wp-block-elasticpress-facet .empty-term:after{bottom:0;content:" ";display:block;left:0;position:absolute;right:0;top:0;width:100%;z-index:2}.widget_ep-facet .level-1,.wp-block-elasticpress-facet .level-1{padding-left:20px}.widget_ep-facet .level-2,.wp-block-elasticpress-facet .level-2{padding-left:40px}.widget_ep-facet .level-3,.wp-block-elasticpress-facet .level-3{padding-left:60px}.widget_ep-facet .level-4,.wp-block-elasticpress-facet .level-4{padding-left:5pc}.widget_ep-facet .level-5,.wp-block-elasticpress-facet .level-5{padding-left:75pt}.widget_ep-facet input[disabled],.wp-block-elasticpress-facet input[disabled]{cursor:pointer;opacity:1}.widget_ep-facet .term a,.wp-block-elasticpress-facet .term a{-webkit-box-align:center;-ms-flex-align:center;align-items:center;display:-webkit-box;display:-ms-flexbox;display:flex;position:relative}.widget_ep-facet .term a:hover .ep-checkbox,.wp-block-elasticpress-facet .term a:hover .ep-checkbox{background-color:#ccc}.ep-checkbox{-webkit-box-align:center;-ms-flex-align:center;-ms-flex-negative:0;-webkit-box-pack:center;-ms-flex-pack:center;align-items:center;background-color:#eee;display:-webkit-box;display:-ms-flexbox;display:flex;flex-shrink:0;height:1em;justify-content:center;margin-right:.25em;width:1em}.ep-checkbox:after{border:solid #fff;border-width:0 .125em .125em 0;content:"";display:none;height:.5em;-webkit-transform:rotate(45deg);transform:rotate(45deg);width:.25em}.ep-checkbox.checked{background-color:#5e5e5e}.ep-checkbox.checked:after{display:block} </style> <link rel='stylesheet' id='all-css-8' href='https://engineering.fb.com/wp-content/mu-plugins/search/elasticpress/dist/css/related-posts-block-styles.min.css?m=1736472017g' type='text/css' media='all' /> <style id='classic-theme-styles-inline-css'> /*! This file is auto-generated */ .wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none} </style> <style id='global-styles-inline-css'> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} :root :where(.wp-block-pullquote){font-size: 1.5em;line-height: 1.6;} </style> <link rel='stylesheet' id='all-css-12' href='https://engineering.fb.com/_static/??-eJyNjt0OgjAMRl/IURAM8cL4KGa2c1T3FzpifHsHSqLxxrv25DtfC/ekMIZsQobkJstBoCBLaZy5zJxYMszkDSoU2cCHmAfjjQBGMupyLti/nJIDHNiRWhKV5/Dj+kmtd68mJ4031XTVFnykyZVSGfRoSBM9lpGD/bvixAFBIrJ2ykUb5WtZvzn6Q9O3+7be9XX3BL6ZYqs=' type='text/css' media='all' /> <script type="text/javascript" src="https://engineering.fb.com/wp-content/plugins/wp-gdpr-consent/dist/gdprconsent.js?ver=2.0.0" id="gdprconsent-js"></script> <script type="text/javascript" id="gdprconsent-js-after"> /* <![CDATA[ */ if (window.gdprSafeTrack) { window.gdprSafeTrack('https://www.googletagmanager.com/gtag/js?id=391063774'); window.gdprSafeTrack(function() { var google_analytics_g4 = decodeURIComponent( '391063774' ); window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', google_analytics_g4); }); } if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { var google_tag_manager = decodeURIComponent( 'GTM-KZRLGZ8' ); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer',google_tag_manager); }); } if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { var facebook_pixel = decodeURIComponent( '660742068067366' ); !function(f,b,e,v,n,t,s) {if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)}; if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0'; n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t,s)}(window, document,'script', 'https://connect.facebook.net/en_US/fbevents.js'); fbq('init', facebook_pixel); fbq('track', 'PageView'); }); } /* ]]> */ </script> <script type="text/javascript" src="https://engineering.fb.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSqy4uT8vJLUvBL9kozUXKCW0ryU1KLikqLEApDugvyCgtQiqHL7XFtDc2NLI0sTY2ODLAD4HjQF" ></script><link rel="https://api.w.org/" href="https://engineering.fb.com/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://engineering.fb.com/wp-json/wp/v2/posts/20224" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://engineering.fb.com/xmlrpc.php?rsd" /> <meta name="generator" content="WordPress 6.7.2" /> <link rel='shortlink' href='https://wp.me/pa0Lhq-5gc' /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://engineering.fb.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fengineering.fb.com%2F2023%2F04%2F13%2Fsecurity%2Fwhatsapp-key-transparency%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://engineering.fb.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fengineering.fb.com%2F2023%2F04%2F13%2Fsecurity%2Fwhatsapp-key-transparency%2F&format=xml" /> <link rel="preload" href="https://engineering.fb.com/wp-content/themes/code-fb-com/fonts/FacebookReader-Medium.woff2" as="font" type="font/woff2" crossorigin="anonymous"><link rel="preload" href="https://engineering.fb.com/wp-content/themes/code-fb-com/fonts/FacebookReader-Regular.woff2" as="font" type="font/woff2" crossorigin="anonymous"><link rel="preload" href="https://engineering.fb.com/wp-content/themes/code-fb-com/fonts/Optimistic_Display_W_Md.woff2" as="font" type="font/woff2" crossorigin="anonymous">  <meta property="og:type" content="article" /> <meta property="og:title" content="Deploying key transparency at WhatsApp" /> <meta property="og:url" content="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/" /> <meta property="og:description" content="WhatsApp has launched a new cryptographic security feature to automatically verify a secured connection based on key transparency. The feature requires no additional actions or steps from users an…" /> <meta property="article:published_time" content="2023-04-13T12:59:32+00:00" /> <meta property="article:modified_time" content="2023-10-19T16:19:51+00:00" /> <meta property="og:site_name" content="Engineering at Meta" /> <meta property="og:image" content="https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg" /> <meta property="og:image:width" content="1920" /> <meta property="og:image:height" content="1080" /> <meta property="og:image:alt" content="" /> <meta property="og:locale" content="en_US" /> <meta name="twitter:text:title" content="Deploying key transparency at WhatsApp" /> <meta name="twitter:image" content="https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg?w=640" /> <meta name="twitter:card" content="summary_large_image" />  <link rel="shortcut icon" href="https://engineering.fb.com/wp-content/themes/code-fb-com/favicon.ico" /> </head> <body class="post-template-default single single-post postid-20224 single-format-standard group-blog"> <div class="hfeed site" id="page">  <div class="wrapper-fluid wrapper-navbar" id="wrapper-navbar"> <a class="skip-link screen-reader-text sr-only" href="#content"> Skip to content </a> <nav class="navbar navbar-expand-std"> <div class="nav-container">  <div class="nav-top-row"> <h1 class="navbar-brand mb-0"> <a rel="home" href="https://engineering.fb.com/" title="Engineering at Meta"> <img class="navbar-brand-logo" src="https://engineering.fb.com/wp-content/themes/code-fb-com/img/logo-meta.svg" class="navbar-brand-logo" alt="Engineering at Meta" width="215" height="40" loading="lazy"> </a> </h1>  <label for="search" class="screen-reader-text">Search this site</label> <input type="text" id="search" name="search" class="form-control-lg navbar-search" autocomplete="off"> <button class="navbar-toggler navbar-searchbar-toggler" type="button" data-toggle="collapse" data-target="#searchbarDropdown" aria-controls="searchbarDropdown" aria-expanded="false" aria-label="Toggle navigation"> <img src="https://engineering.fb.com/wp-content/themes/code-fb-com/img/icon-search.svg" class="navbar-mobile-search-icon" loading="lazy" width="24" height="25" /> </button>  <div class="notranslate nice-select navbar-language form-control"> </div> <button class="navbar-toggler collapsed navbar-menu-toggler" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> </div> <div class="navbar-border"></div>  <div id="navbarNavDropdown" class="collapse navbar-collapse"><ul id="main-menu" class="navbar-nav"><li id="menu-item-60" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-60 dropdown"><a title="Open Source" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Open Source <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-12330" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent nav-item menu-item-12330"><a title="Open Source" href="https://engineering.fb.com/category/open-source/" class="nav-link">Open Source</a></li> <li id="menu-item-12331" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-12331"><a title="Meta Open Source" href="https://opensource.fb.com" class="nav-link">Meta Open Source</a></li> </ul> </li> <li id="menu-item-2686" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2686 dropdown"><a title="Platforms" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Platforms <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-65" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent nav-item menu-item-65"><a title="Android" href="https://engineering.fb.com/category/android/" class="nav-link">Android</a></li> <li id="menu-item-66" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent nav-item menu-item-66"><a title="iOS" href="https://engineering.fb.com/category/ios/" class="nav-link">iOS</a></li> <li id="menu-item-67" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-67"><a title="Web" href="https://engineering.fb.com/category/web/" class="nav-link">Web</a></li> </ul> </li> <li id="menu-item-2682" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2682 dropdown"><a title="Infrastructure Systems" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Infrastructure Systems <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-218" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-218"><a title="Core Infra" href="https://engineering.fb.com/category/core-infra/" class="nav-link">Core Infra</a></li> <li id="menu-item-219" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-219"><a title="Data Infrastructure" href="https://engineering.fb.com/category/data-infrastructure/" class="nav-link">Data Infrastructure</a></li> <li id="menu-item-220" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-220"><a title="DevInfra" href="https://engineering.fb.com/category/developer-tools/" class="nav-link">DevInfra</a></li> <li id="menu-item-226" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-226"><a title="Production Engineering" href="https://engineering.fb.com/category/production-engineering/" class="nav-link">Production Engineering</a></li> <li id="menu-item-227" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent nav-item menu-item-227"><a title="Security" href="https://engineering.fb.com/category/security/" class="nav-link">Security</a></li> <li id="menu-item-18607" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-18607"><a title="Research Publications" href="https://research.facebook.com/publications/research-areas/systems-infrastructure/" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-2683" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2683 dropdown"><a title="Physical Infrastructure" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Physical Infrastructure <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-215" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-215"><a title="Connectivity" href="https://engineering.fb.com/category/connectivity/" class="nav-link">Connectivity</a></li> <li id="menu-item-216" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-216"><a title="Data Center Engineering" href="https://engineering.fb.com/category/data-center-engineering/" class="nav-link">Data Center Engineering</a></li> <li id="menu-item-217" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-217"><a title="Networking & Traffic" href="https://engineering.fb.com/category/networking-traffic/" class="nav-link">Networking & Traffic</a></li> <li id="menu-item-18608" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-18608"><a title="Research Publications" href="https://research.facebook.com/publications/research-areas/networking-connectivity/" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-2684" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2684 dropdown"><a title="Video Engineering & AR/VR" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Video Engineering & AR/VR <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-225" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-225"><a title="Video Engineering" href="https://engineering.fb.com/category/video-engineering/" class="nav-link">Video Engineering</a></li> <li id="menu-item-223" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-223"><a title="Virtual Reality" href="https://engineering.fb.com/category/virtual-reality/" class="nav-link">Virtual Reality</a></li> <li id="menu-item-13388" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-13388"><a title="Research Publications" href="https://research.facebook.com/publications/research-areas/augmented-reality-virtual-reality/" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-2685" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children nav-item menu-item-2685 dropdown"><a title="Artificial Intelligence" href="#" data-toggle="dropdown" class="nav-link dropdown-toggle">Artificial Intelligence <span class="caret"></span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" viewBox="0 0 129 129" enable-background="new 0 0 129 129" width="12px" height="15px"> <polyline points="40 50 80 90 120 50" stroke="#adb1b8" stroke-width="10" stroke-linecap="butt" fill="none" stroke-linejoin="miter"/> </svg></a> <ul class=" dropdown-menu" role="menu"> <li id="menu-item-222" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-222"><a title="ML Applications" href="https://engineering.fb.com/category/ml-applications/" class="nav-link">ML Applications</a></li> <li id="menu-item-221" class="menu-item menu-item-type-taxonomy menu-item-object-category nav-item menu-item-221"><a title="AI Research" href="https://engineering.fb.com/category/ai-research/" class="nav-link">AI Research</a></li> <li id="menu-item-13387" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-13387"><a title="Research Publications" href="https://ai.facebook.com/results/?content_types%5B0%5D=publication" class="nav-link">Research Publications</a></li> </ul> </li> <li id="menu-item-228" class="menu-item menu-item-type-custom menu-item-object-custom nav-item menu-item-228"><a title="Watch Videos" href="/videos" class="nav-link">Watch Videos</a></li> </ul></div> </div> <div class="search-container collapse" id="searchbarDropdown"> <div class="searchbar-search"> <div class="searchbar-container"> <div class="navbar-mobile-search-margin"></div> <input type="text" name="search" placeholder="Search" class="form-control-lg navbar-mobile-search" autofocus autocomplete="off"> <button class="searchbar-clear"> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> </div> </div> </div> </nav> </div> <div class="wrapper" id="single-wrapper"> <div class="single-container row" id="content" tabindex="-1">  <div class="content-area" id="primary"> <main class="site-main" id="main"> <article class="post-20224 post type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-20224"> <header class="entry-header"> <div class="entry-meta"> POSTED ON <span class="posted-on entry-date"><time class="published updated" datetime="2023-04-13">APRIL 13, 2023</time></span> TO <span class="cat-links"><a href="https://engineering.fb.com/category/android/" rel="category tag">Android</a>, <a href="https://engineering.fb.com/category/ios/" rel="category tag">iOS</a>, <a href="https://engineering.fb.com/category/open-source/" rel="category tag">Open Source</a>, <a href="https://engineering.fb.com/category/security/" rel="category tag">Security</a></span> <h1 class="entry-title"><div>Deploying key transparency at WhatsApp</div></h1> </div> </header> <figure id="post-feat-image-container"> <img width="1920" height="1080" src="https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight.jpg" class="wp-post-image" alt="" title="Eng-Blog-Self-Serve-Hero-Images-PRIVACY-101-TealeLight" /> </figure> <div class="entry-authors-social"> <div class="entry-authors"> By <a href="https://engineering.fb.com/author/sean-lawlor/" title="Posts by Sean Lawlor" class="author url fn" rel="author">Sean Lawlor</a>, <a href="https://engineering.fb.com/author/kevin-lewi/" title="Posts by Kevin Lewi" class="author url fn" rel="author">Kevin Lewi</a> </div> <div class="entry-social"> <div class="entry-facebook"> <button onclick="return fbShare()" aria-label="Share this post on Facebook"> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M9 8h-3v4h3v12h5v-12h3.642l.358-4h-4v-1.667c0-.955.192-1.333 1.115-1.333h2.885v-5h-3.808c-3.596 0-5.192 1.583-5.192 4.615v3.385z"/></svg> </button> </div> <div class="entry-twitter"> <button onclick="return twitterSharePopup('https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/')" aria-label="Share this post on Twitter"> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M24 4.557c-.883.392-1.832.656-2.828.775 1.017-.609 1.798-1.574 2.165-2.724-.951.564-2.005.974-3.127 1.195-.897-.957-2.178-1.555-3.594-1.555-3.179 0-5.515 2.966-4.797 6.045-4.091-.205-7.719-2.165-10.148-5.144-1.29 2.213-.669 5.108 1.523 6.574-.806-.026-1.566-.247-2.229-.616-.054 2.281 1.581 4.415 3.949 4.89-.693.188-1.452.232-2.224.084.626 1.956 2.444 3.379 4.6 3.419-2.07 1.623-4.678 2.348-7.29 2.04 2.179 1.397 4.768 2.212 7.548 2.212 9.142 0 14.307-7.721 13.995-14.646.962-.695 1.797-1.562 2.457-2.549z"/></svg> </button> </div> <div class="entry-hacker-news"> <button onclick="return shareHackerNews('https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/')" aria-label="Share this post on Hacker News"> <svg width="24" height="24" xmlns="http://www.w3.org/2000/svg"><path d="M13.693 14.659L21.507 0h-3.29l-4.612 9.165c-.47.94-.901 1.841-1.293 2.703l-1.234-2.703L6.525 0H3l7.726 14.482V24h2.967v-9.341z" fill-rule="nonzero"/></svg> </button> </div> </div> </div> <div class="entry-content"> <ul> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">WhatsApp has launched a <a href="https://www.whatsapp.com/security/WhatsApp-Key-Transparency-Whitepaper.pdf" target="_blank" rel="noopener">new cryptographic security feature</a> to automatically verify a secured connection based on key transparency. </span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The feature requires no additional actions or steps from users and helps ensure that a conversation is secure. </span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Key transparency solutions help strengthen the guarantee that end-to-end encryption provides to private, personal messaging applications in a transparent manner available to all. </span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">We have published an open-source library called </span><a href="https://github.com/facebook/akd/" target="_blank" rel="noopener"><span style="font-weight: 400;">Auditable Key Directory (AKD)</span></a><span style="font-weight: 400;">. This enables anyone to verify audit proofs of the directory’s correctness. This underpins our key transparency deployment.</span></li> </ul> <p><span style="font-weight: 400;">End-to-end encryption is the foundation of private messaging on WhatsApp, helping to ensure that only you and the person you’re communicating with can read what’s sent, and nobody in between, not even WhatsApp. It is among the most widely used deployments of end-to-end encryption and relies on public key cryptography first developed in the 1970s. From a technical point of view, for end-to-end encryption to be trusted, the “ends” of a conversation need to know that one another’s encryption keys are authentic and valid. </span></p> <p><span style="font-weight: 400;">To do so, our most security conscious users have always been able to take advantage of our </span><a href="https://faq.whatsapp.com/820124435853543" target="_blank" rel="noopener"><span style="font-weight: 400;">security code verification feature</span></a><span style="font-weight: 400;"> available under a user’s contact info. When in person, keys can be validated with a quick QR code scan or, if remote, sharing the unique 60-digit code. </span></p> <p><span style="font-weight: 400;">This is the one of the strongest ways of verifying if a connection is secure. But in reality we know that double checking a long code is cumbersome, and our team has been looking at ways to make this easier for some time.</span></p> <p><span style="font-weight: 400;">We’re excited to introduce a new cryptographic security feature to automatically verify a secure connection without the need for this long code. To do so, we’re building on key transparency by developing a new </span><span style="font-weight: 400;">Auditable Key Directory (AKD)</span><span style="font-weight: 400;">, which is based on an </span><a href="https://github.com/facebook/akd" target="_blank" rel="noopener"><span style="font-weight: 400;">open-sourced library</span></a><span style="font-weight: 400;">. The AKD will enable WhatsApp clients to automatically validate that a user’s encryption key is genuine and enables anyone to verify audit proofs of the directory’s correctness.</span></p> <p><span style="font-weight: 400;">Our approach to key transparency is two-pronged and introduces two new components: </span><span style="font-weight: 400;"> </span></p> <ol> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The server (WhatsApp) maintains an append-only AKD of public keys mapped to user accounts.</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">A third-party audit record, wherein any change in the server directory is recorded in a publicly available, privacy-preserving audit record for anyone to verify.</span></li> </ol> <p><span style="font-weight: 400;">With these two additions, users can automatically verify their conversation security thanks to the WhatsApp directory. As this is rolled out, security-conscious users who utilize the verify security code page will notice this verification process occurs quickly and automatically. </span></p> <p><span style="font-weight: 400;">This system is a new service provided by WhatsApp that relies on public auditing to verify the end-to-end encryption status of personal conversations. While this system provides easy and convenient verification tools to our users, those who wish to verify their end-to-end encrypted sessions without utilizing WhatsApp servers at all are encouraged to utilize the traditional security code verification process in addition to this new automated process. </span></p> <p><span style="font-weight: 400;">The public keys are only a tool that users have to encrypt their messages. The private key – which is used to decrypt messages – is on user devices. Nobody – not even WhatsApp – has access to those private keys. A list of public keys alone cannot provide access to anyone’s content. </span></p> <h2><span style="font-weight: 400;">How the “Verify Security Code” page works</span></h2> <p><span style="font-weight: 400;">The crux of end-to-end encrypted messaging is public/private key pairs. The private key is what you utilize to decrypt your messages sent from another party and never leaves your device. The public key, however, is what you give to others so they can encrypt messages. This is done by first giving the key to WhatsApp, where we store it on your behalf and give it to users who wish to message you.</span></p> <p><span style="font-weight: 400;">The classic concern that end-to-end encryption was designed to guard against is a person-in-the-middle attack where you </span><i><span style="font-weight: 400;">think</span></i><span style="font-weight: 400;"> you’re talking to just one user; however, you’re actually talking to a middle-man attacker, who provides an incorrect public key so that they hold the private key and can read your messages. The attacker may then use the correct public key for your contact, re-encrypt the message with it, and send it to the user. </span><span style="font-weight: 400;"><br /> </span><span style="font-weight: 400;"><br /> </span><span style="font-weight: 400;">What stops this today? WhatsApp has a </span><i><span style="font-weight: 400;">Security Page</span></i><span style="font-weight: 400;"> for each contact that has a QR code and a 60-digit number that can be verified outside of WhatsApp to make sure it matches what your contact sees on their device. In short, it’s a unique hash of both your public keys and their public keys, so if either of you have the wrong value, the hashes won’t match. When they do match this confirms a secure, end-to-end encrypted conversation. </span></p> <h2><span style="font-weight: 400;">What’s the problem key transparency is fixing?</span></h2> <p><span style="font-weight: 400;">While providing a strong guarantee of security, the QR code scanning/number matching feature requires communicating with your contacts outside of WhatsApp – whether it’s over a video-call, in real-life, on the phone, etc. This is:</span></p> <ol> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Difficult to do in 1:1 communications, especially as users change devices (and therefore encryption keys) over time;</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Even harder in small groups, since each </span><i><span style="font-weight: 400;">pair</span></i><span style="font-weight: 400;"> of participants has a unique code (there are no “group” codes); </span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Is near-impossible to perform in large groups. Every time someone joins or leaves, enrolls a new companion device, changes their phone, etc. this needs to be redone for all participants. For example, in a group of 100 people, that’s 4950 pairs of security verifications.</span></li> </ol> <p><span style="font-weight: 400;">Ideally, this wouldn’t be a manual process and could be verified through some kind of automated flow. </span></p> <p><span style="font-weight: 400;">Enter </span><b>key</b> <strong>transparency</strong>: A <span style="font-weight: 400;">protocol in which we establish an AKD on WhatsApp that maintains a record of public key changes. Additionally, we’ve established a third-party public repository of auditable change logs to the directory that updates whenever there’s additions to the directory. This is vital for transparency and to further strengthen our end-to-end encrypted guarantee. In effect, this confirms that the same public keys a user uses to contact a recipient are the same ones that everybody else also uses to communicate with the recipient. </span></p> <p><span style="font-weight: 400;">Although key transparency does not substitute QR code scanning, it enhances and complements it in the following ways:</span></p> <ol> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">QR code scanning requires two people to coordinate out-of-band verification. In contrast, key transparency requires only a single client to initiate and perform a check against the directory, thus improving accessibility of the check process;</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Key transparency serves as a public key consistency mechanism when manual QR code verification is impractical (for example in large group communication scenario); </span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">It also serves as a lightweight first-check of end-to-end encryption, which improves adoption of end-to-end encryption checks to more users, benefiting messaging security at-large.</span></li> </ol> <p><span style="font-weight: 400;">In the event that the automatic check returns a result showing that the connection may not be secure, we recommend users proceed with the manual security verification check. </span></p> <h2><span style="font-weight: 400;">The history of key transparency</span></h2> <p><span style="font-weight: 400;">Key transparency describes a protocol in which the server maintains an append-only record of the mapping between a user’s account and their public identity key. </span><span style="font-weight: 400;">This allows the generation of </span><i><span style="font-weight: 400;">inclusion</span></i><span style="font-weight: 400;"> proofs to assert that a given mapping exists in the directory at the time of the most recent update. </span></p> <p><span style="font-weight: 400;">WhatsApp’s realization of key transparency is based on the original academic works on key transparency, starting with </span><a href="https://eprint.iacr.org/2014/1004.pdf"><span style="font-weight: 400;">CONIKS</span></a><span style="font-weight: 400;"> and </span><a href="https://eprint.iacr.org/2018/607.pdf"><span style="font-weight: 400;">SEEMless</span></a><span style="font-weight: 400;">, with extensions from a recent paper called </span><a href="https://eprint.iacr.org/2023/081.pdf"><span style="font-weight: 400;">Parakeet</span></a><span style="font-weight: 400;">. Together, this resulted in the Rust </span><a href="https://github.com/facebook/akd/"><span style="font-weight: 400;">AKD</span></a><span style="font-weight: 400;"> crate, which serves as the foundation for maintaining a key transparency solution along with generating inclusion and key history proofs from the directory. WhatsApp is hosting this AKD directory as an infrastructure available to all of our users.</span></p> <p><span style="font-weight: 400;">Public keys cannot be used to decrypt a user’s messages or determine who you’ve been talking to. They are, however, necessary to make sure that someone is sending a message to the intended recipient by encrypting messages that only the holder of the public key’s associated private key can read. </span></p> <p><span style="font-weight: 400;">A user may have many entries as they update their key over time. At WhatsApp’s scale this equates to billions of entries continually growing over time. When a user deletes their account, we remove all of the public keys for that account, but the fact a key existed at a point in time is immutable (we just can’t say what the key was).</span></p> <h2><span style="font-weight: 400;">How does key transparency work?</span></h2> <h3><span style="font-weight: 400;">Security on principle</span></h3> <p><span style="font-weight: 400;">From a core design choice, multiple factors helped us decide to enhance the openness and security of this project. </span><a href="https://github.com/facebook/akd"><span style="font-weight: 400;">First off, the AKD, with all of its proof generation and verification logic, is open-source code.</span></a><span style="font-weight: 400;"> This is a <a href="https://engineering.fb.com/2021/04/29/developer-tools/rust/" target="_blank" rel="noopener">Rust</a>-based crate (library) for any entity that wants to manage an append-only directory with a publicly verifiable log or verify append-only audit proofs and participate as a public auditor of WhatsApp’s key transparency solution. A list of public keys alone cannot provide access to anyone’s content. </span></p> <p><span style="font-weight: 400;">This library allows for the system to provide a significant guarantee on the correctness of the directory entries while not compromising security by being vulnerable to memory-based attacks. Additionally, we stuck with the decision to utilize Rust in most of the internal components outlined below. </span></p> <h2><span style="font-weight: 400;">Applying AKD to WhatsApp</span></h2> <h3><span style="font-weight: 400;">High-volume key changes </span></h3> <p><span style="font-weight: 400;">WhatsApp deals with tens of thousands of key changes (registration, re-registration, etc.) per minute. This kind of volume is difficult to deal with when trying to insert into an append-only log. </span></p> <p><span style="font-weight: 400;">Therefore, we decided to implement a distributed, high-throughput queue where “pending changes” live prior to being gathered together into a batch and inserted to form the next epoch. This allows us to do far larger batch inserts and greatly limits the number of database operations we need to make. </span></p> <p><span style="font-weight: 400;">Since the changes to the AKD are additive based on the previous </span><i><span style="font-weight: 400;">epoch</span></i><span style="font-weight: 400;"> we need to make sure that only a single update occurs at a time. A single processor, sequentially handling each update one-by-one, wouldn’t be able to keep up with the rate of changes within WhatsApp (no matter the database implementation). This adds some latency from the time a key is added or updated to when it’s “published” in the directory. </span></p> <p><span style="font-weight: 400;">By batching keys together and making an </span><i><span style="font-weight: 400;">epoch</span></i><span style="font-weight: 400;"> a collection of changes committed atomically, we can benefit from a lot of query optimizations due to many shared paths in the Merkle Tree stored in the database. The frequency to publish and emit new </span><i><span style="font-weight: 400;">epochs</span></i><span style="font-weight: 400;"> is a tunable parameter that may be adjusted over time.</span></p> <h3><span style="font-weight: 400;">Public auditing at scale</span></h3> <p><span style="font-weight: 400;">The general requirement for all transparency solutions is to be </span><i><span style="font-weight: 400;">publicly auditable</span></i><span style="font-weight: 400;">, meaning that anyone, should they want to, can verify the transactions on the directory to assert that: </span></p> <ol> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">The history hasn’t been changed (existing records aren’t deleted or updated).</span></li> <li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">Changes are append-only.</span></li> </ol> <p><span style="font-weight: 400;">When publishing a new change to the AKD, we emit an audit proof of those changes that is put into public storage for anyone interested. These audit records guarantee the properties of immutable history for anyone to verify should they want to while preserving the privacy of all users in the directory. </span></p> <p><span style="font-weight: 400;">This does not risk anyone’s actual info from being public, nor does it reveal any patterns of behavior for any users. You can read more about how this privacy guarantee works as outlined in </span><a href="https://eprint.iacr.org/2018/607.pdf"><span style="font-weight: 400;">SEEMless</span><span style="font-weight: 400;"> and</span></a> <a href="https://eprint.iacr.org/2023/081.pdf"><span style="font-weight: 400;">Parakeet</span></a><span style="font-weight: 400;">, the academic works from which key transparency is based off.</span></p> <h2><span style="font-weight: 400;">WhatsApp’s key transparency rollout</span></h2> <p><span style="font-weight: 400;">Key transparency solutions help strengthen the guarantee that end-to-end encryption provides to private personal messaging applications in a transparent manner available to all. This technology underpins WhatsApp commitment and leadership in the security domain.</span></p> <p><span style="font-weight: 400;">WhatsApp is already hosting and operating an AKD for all of our users, regardless of the version or platform of the application you’re utilizing. Users who utilize the verify security code function will start to notice that the verification is automatic as this rolls out on Android in the coming months. This is an important mechanism that empowers security-conscious users to verify an end-to-end encrypted personal conversation quickly. </span></p> <h2>Read the whitepaper</h2> <p><span style="font-weight: 400;">Read the <a href="https://www.whatsapp.com/security/WhatsApp-Key-Transparency-Whitepaper.pdf" target="_blank" rel="noopener">WhatsApp Key Transparency Overview whitepaper</a> for a more technical deep-dive that goes through potential attacks, additional details on data-flows, and formats.</span></p> <div class="sharedaddy sd-sharing-enabled"><div class="robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing"><h3 class="sd-title">Share this:</h3><div class="sd-content"><ul><li class="share-facebook"><a rel="nofollow noopener noreferrer" data-shared="sharing-facebook-20224" class="share-facebook sd-button share-icon" href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/?share=facebook" target="_blank" title="Click to share on Facebook" ><span>Facebook</span></a></li><li class="share-custom share-custom-threads"><a rel="nofollow noopener noreferrer" data-shared="" class="share-custom share-custom-threads sd-button share-icon" href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/?share=custom-1706294701" target="_blank" title="Click to share on Threads" ><span style="background-image:url("https://engineering.fb.com/wp-content/uploads/2024/01/threads-app-icon.png");">Threads</span></a></li><li class="share-x"><a rel="nofollow noopener noreferrer" data-shared="sharing-x-20224" class="share-x sd-button share-icon" href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/?share=x" target="_blank" title="Click to share on X" ><span>X</span></a></li><li class="share-linkedin"><a rel="nofollow noopener noreferrer" data-shared="sharing-linkedin-20224" class="share-linkedin sd-button share-icon" href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/?share=linkedin" target="_blank" title="Click to share on LinkedIn" ><span>LinkedIn</span></a></li><li class="share-custom share-custom-hackernews"><a rel="nofollow noopener noreferrer" data-shared="" class="share-custom share-custom-hackernews sd-button share-icon" href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/?share=custom-1699562127" target="_blank" title="Click to share on Hacker News" ><span style="background-image:url("https://news.ycombinator.com/y18.svg");">Hacker News</span></a></li><li class="share-email"><a rel="nofollow noopener noreferrer" data-shared="" class="share-email sd-button share-icon" href="mailto:?subject=%5BShared%20Post%5D%20Deploying%20key%20transparency%20at%20WhatsApp&body=https%3A%2F%2Fengineering.fb.com%2F2023%2F04%2F13%2Fsecurity%2Fwhatsapp-key-transparency%2F&share=email" target="_blank" title="Click to email a link to a friend" data-email-share-error-title="Do you have email set up?" data-email-share-error-text="If you're having problems sharing via email, you might not have email set up for your browser. You may need to create a new email yourself." data-email-share-nonce="f5cce86cf6" data-email-share-track-url="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/?share=email"><span>Email</span></a></li><li class="share-end"></li></ul></div></div></div> </div> </article> <footer class="entry-footer"> <div>TAGS:      <a href="https://engineering.fb.com/tag/whatsapp/" rel="tag">WhatsApp</a></div> </footer> <div class="fb-like" data-href="https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/" data-width="" data-layout="standard" data-action="like" data-size="small" data-share="true"> </div> <div class="related-articles"> <div class="related-articles__header"> <h3 class="related-articles__header__headline">Read More in Security</h3> <a aria-label="View all articles in this Security" class="related-articles__header__link" href="https://engineering.fb.com/category/security/" > View All </a> </div> <div class="article-grids related-articles__grid"> <div class="row"> <div class="article-grid col-12 col-md-4"> <article class="post post-20224 type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-22260"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2022/11/Debugging-Hero.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2025-02-13T09:00:46-08:00"> FEB 13, 2025 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2025/02/13/security/looking-back-at-our-bug-bounty-program-in-2024/" rel="bookmark" aria-label="Read More about Looking back at our Bug Bounty program in 2024"> Looking back at our Bug Bounty program in 2024 </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20224 type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-22242"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2021/10/RiB_DarkBlue.jpg?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" title="RiB_DarkBlue_Tile" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2025-02-05T10:30:51-08:00"> FEB 5, 2025 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2025/02/05/security/revolutionizing-software-testing-llm-powered-bug-catchers-meta-ach/" rel="bookmark" aria-label="Read More about Revolutionizing software testing: Introducing LLM-powered bug catchers"> Revolutionizing software testing: Introducing LLM-powered bug catchers </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20224 type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-22222"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/11/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Teale-x2.jpg?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" title="Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Teale-x2" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2025-02-04T12:00:18-08:00"> FEB 4, 2025 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2025/02/04/security/data-logs-the-latest-evolution-in-metas-access-tools/" rel="bookmark" aria-label="Read More about Data logs: The latest evolution in Meta’s access tools"> Data logs: The latest evolution in Meta’s access tools </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20224 type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-22168"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2025/01/LINEAGE_HEADER_IMAGE.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2025-01-22T21:00:45-08:00"> JAN 22, 2025 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2025/01/22/security/how-meta-discovers-data-flows-via-lineage-at-scale/" rel="bookmark" aria-label="Read More about How Meta discovers data flows via lineage at scale"> How Meta discovers data flows via lineage at scale </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20224 type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-21935"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/11/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-Teale-x2_small.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-11-12T09:00:10-08:00"> NOV 12, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/11/12/security/how-meta-built-large-scale-cryptographic-monitoring/" rel="bookmark" aria-label="Read More about How Meta built large-scale cryptographic monitoring"> How Meta built large-scale cryptographic monitoring </a> </div> </div> </header> </article> </div> <div class="article-grid col-12 col-md-4"> <article class="post post-20224 type-post status-publish format-standard has-post-thumbnail hentry category-android category-ios category-open-source category-security tag-whatsapp fb_content_type-article" id="post-21812"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2024/10/WhatsApp-IPLS-image-3_crop.png?w=580&h=326&crop=1" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /> <header class="entry-header"> <div class="entry-header__top"> <span class="posted-on"> <time class="entry-date published" datetime="2024-10-22T05:59:46-07:00"> OCT 22, 2024 </time> </span> </div> <div class="entry-title"> <div> <a href="https://engineering.fb.com/2024/10/22/security/ipls-privacy-preserving-storage-for-your-whatsapp-contacts/" rel="bookmark" aria-label="Read More about IPLS: Privacy-preserving storage for your WhatsApp contacts"> IPLS: Privacy-preserving storage for your WhatsApp contacts </a> </div> </div> </header> </article> </div> </div> </div> </div>  </main> </div>  <div class="col-md-4 widget-area" id="right-sidebar" role="complementary"> <aside id="fb_related_post_widget-4" class="widget widget_fb_related_post_widget"><h3 class="widget-title">Related Posts</h3><hr> <div class="aside-related-projects"><div class="article-grid-redesign"> <article class="post-20180 post type-post status-publish has-post-thumbnail hentry" id="post-20180"> <a href="https://engineering.fb.com/2023/04/13/security/whatsapp-device-verification-protects-your-account/" rel="bookmark" aria-label="Read More about How Device Verification protects your WhatsApp account"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-TealeLight.jpg?w=580&h=326&crop=1" class="wp-post-image" alt="" srcset="https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-TealeLight.jpg?w=580&h=326&crop=1 580w, https://engineering.fb.com/wp-content/uploads/2023/04/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-TealeLight.jpg?w=580&h=326&crop=1 326w" sizes="(max-width: 580px) 100vw, 580px" loading="lazy"> <header class="entry-header"> <span class="posted-on"><time class="entry-date published" datetime="Apr 13, 2023">Apr 13, 2023</time></span> <h4 class="entry-title">How Device Verification protects your WhatsApp account</h4> </header> </a> </article> </div><div class="article-grid-redesign"> <article class="post-18065 post type-post status-publish has-post-thumbnail hentry" id="post-18065"> <a href="https://engineering.fb.com/2021/09/10/security/whatsapp-e2ee-backups/" rel="bookmark" aria-label="Read More about How WhatsApp is enabling end-to-end encrypted backups"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2021/09/Whatsapp_E2EE-Backups_EngBlog-1.png?w=580&h=326&crop=1" class="wp-post-image" alt="" srcset="https://engineering.fb.com/wp-content/uploads/2021/09/Whatsapp_E2EE-Backups_EngBlog-1.png?w=580&h=326&crop=1 580w, https://engineering.fb.com/wp-content/uploads/2021/09/Whatsapp_E2EE-Backups_EngBlog-1.png?w=580&h=326&crop=1 326w" sizes="(max-width: 580px) 100vw, 580px" loading="lazy"> <header class="entry-header"> <span class="posted-on"><time class="entry-date published" datetime="Sep 10, 2021">Sep 10, 2021</time></span> <h4 class="entry-title">How WhatsApp is enabling end-to-end encrypted backups</h4> </header> </a> </article> </div><div class="article-grid-redesign"> <article class="post-18540 post type-post status-publish has-post-thumbnail hentry" id="post-18540"> <a href="https://engineering.fb.com/2022/03/10/security/code-verify/" rel="bookmark" aria-label="Read More about Code Verify: An open source browser extension for verifying code authenticity on the web"> <img width="580" height="326" src="https://engineering.fb.com/wp-content/uploads/2022/03/WhatsApp-Code-Verify-Hero2.jpg?w=580&h=326&crop=1" class="wp-post-image" alt="" srcset="https://engineering.fb.com/wp-content/uploads/2022/03/WhatsApp-Code-Verify-Hero2.jpg?w=580&h=326&crop=1 580w, https://engineering.fb.com/wp-content/uploads/2022/03/WhatsApp-Code-Verify-Hero2.jpg?w=580&h=326&crop=1 326w" sizes="(max-width: 580px) 100vw, 580px" loading="lazy"> <header class="entry-header"> <span class="posted-on"><time class="entry-date published" datetime="Mar 10, 2022">Mar 10, 2022</time></span> <h4 class="entry-title">Code Verify: An open source browser extension for verifying code authenticity on the web</h4> </header> </a> </article> </div></div></aside><aside id="wpb_widget-3" class="widget widget_wpb_widget"><h3 class="widget-title">Related Positions</h3><hr><ul class="available-positions-list"><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> BELLEVUE, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> REDMOND, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> MENLO PARK, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> SEATTLE, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> BURLINGAME, US </div> </a> </li> </ul> <a href="https://www.metacareers.com"> <div class="btn available-positions-btn"> See All Jobs </div> </a> </aside> </div>   </div> </div> </div>  <div class="wrapper wrapper-community-outer"> <div class="wrapper-community"> <div class="community" tabindex="-1"> <div class="row">  <div id="wpb_widget-2" class="footer-widget widget_wpb_widget widget-count-3 col-md-4"><h3 class="widget-title">Available Positions</h3><hr><ul class="available-positions-list"><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> BELLEVUE, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> REDMOND, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> MENLO PARK, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> SEATTLE, US </div> </a> </li><li class="available-positions-item"> <a href=https://www.metacareers.com/jobs/1320924245499342/> <div class="job-description"> Software Engineer, Android </div> <div class="job-location"> BURLINGAME, US </div> </a> </li> </ul> <a href="https://www.metacareers.com"> <div class="btn available-positions-btn"> See All Jobs </div> </a> </div><div id="custom_html-2" class="widget_text footer-widget widget_custom_html widget-count-3 col-md-4"><h3 class="widget-title">Technology at Meta</h3><div class="textwidget custom-html-widget"><ul class="stay-connected-lists"> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-fb-engineering" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Engineering at Meta - X </div> <a onclick='return twitterFollow("fb_engineering")'> <button class="btn stay-connected-btn"> Follow </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-AI" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> AI at Meta </div> <a href="https://ai.meta.com/blog/"> <button class="btn stay-connected-btn"> Read </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-developers" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Meta Quest Blog </div> <a href="https://www.meta.com/blog/quest/"> <button class="btn stay-connected-btn"> Read </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-developers" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Meta for Developers </div> <a href="https://developers.facebook.com/"> <button class="btn stay-connected-btn"> Read </button> </a> </div> </li> <li class="stay-connected-item"> <img class="footer-fb-engineering stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/meta_logo.png" alt="footer-bug-bounty" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> Meta Bug Bounty </div> <a href="https://bugbounty.meta.com/"> <button class="btn stay-connected-btn"> Learn more </button> </a> </div> </li> <li class="stay-connected-item"> <img class="stay-connected-item-left" src="/wp-content/themes/code-fb-com/img/rss.png" alt="footer-rss" loading="lazy" width="70" height="70"> <div class="stay-connected-item-right"> <div class="stay-connected-label"> RSS </div> <a href="https://code.facebook.com/posts/rss/"> <button class="btn stay-connected-btn"> Subscribe </button> </a> </div> </li> </ul> </div></div><div id="custom_html-3" class="widget_text footer-widget widget_custom_html widget-count-3 col-md-4"><h3 class="widget-title">Open Source</h3><div class="textwidget custom-html-widget"><p class="opensource-desc"> Meta believes in building community through open source technology. Explore our latest projects in Artificial Intelligence, Data Infrastructure, Development Tools, Front End, Languages, Platforms, Security, Virtual Reality, and more. </p> <ul class="opensource-cats"> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/android.png" alt="android" loading="lazy" width="50" height="59"> <div class="opensource-cap"> ANDROID </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/ios.png" alt="ios" loading="lazy" width="48" height="58"> <div class="opensource-cap"> iOS </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/web.png" alt="web" loading="lazy" width="55" height="49"> <div class="opensource-cap"> WEB </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/backend.png" alt="backend" loading="lazy" width="56" height="51"> <div class="opensource-cap"> BACKEND </div> </li> <li class="opensource-cat"> <img src="/wp-content/themes/code-fb-com/img/hardware.png" alt="hardware" loading="lazy" width="55" height="44"> <div class="opensource-cap"> HARDWARE </div> </li> </ul> <button class="btn opensource-btn" onclick="window.location.href='https://opensource.fb.com/'"> Learn More </button> </div></div> </div> </div> </div> </div> <div class="wrapper-footer" id="wrapper-footer"> <div class="inner-container"> <div class="footer"> <div class="row"> <div class="col-md-12"> <footer class="meta-footer" id="meta-footer"> <div class="site-info row justify-content-between"> <div class="col-md-5 meta-logo-container"> <a href="https://about.facebook.com/"> <img src="https://engineering.fb.com/wp-content/themes/code-fb-com/img/meta_logo_full.svg" width="89" height="18" alt="Meta" /> </a> <div id="text-2" class="widget widget_text"> <div class="textwidget"><p>Engineering at Meta is a technical news resource for engineers interested in how we solve large-scale technical challenges at Meta.</p> </div> </div> </div> <div class="col-md-6 footer-meta-links-container"> <ul class="meta-footer-links"> <li class="footer-link"><a href="https://engineering.fb.com">Home</a></li><li class="footer-link"><a href="https://about.meta.com/">Company Info</a></li><li class="footer-link"><a href="https://www.metacareers.com/?ref=engineering.fb.com">Careers</a></li> </ul> </div> </div> </footer> </div> </div> </div> </div> <div class="footer"> <div class="row"> <div class="col-md-12"> <footer class="site-footer" id="colophon"> <div class="inner-container"> <div class="site-info row justify-content-between"> <div class="col-md-4 copyright-container"> <div class="copyright"> © 2025 Meta</div> </div>  <div class="col-md-7 footer-links-container"> <ul class="footer-links"> <li class="footer-link"><a href="https://www.facebook.com/policies">Terms</a></li><li class="footer-link"><a href="https://www.facebook.com/privacy/policy">Privacy</a></li><li class="footer-link"><a href="/privacy">Cookies</a></li><li class="footer-link"><a href="https://www.facebook.com/help">Help</a></li> </ul> </div> </div> </div> </footer> </div> </div> </div> </div> </div> <div class="gdprconsent-container" id="GDPRConsentBar"> <div class="gdprconsent-wrapper"> <div class="gdprconsent-content"> <p>To help personalize content, tailor and measure ads and provide a safer experience, we use cookies. By clicking or navigating the site, you agree to allow our collection of information on and off Facebook through cookies. Learn more, including about available controls: <a href="/privacy">Cookie Policy</a></p> <div class="gdprconsent-button"> <button type="button" data-gdpr-accept>Accept</button> </div> </div> </div> </div>  <script> if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { !function(e,t,n,s,u,a){e.twq||(s=e.twq=function(){s.exe?s.exe.apply(s,arguments):s.queue.push(arguments); },s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='//static.ads-twitter.com/uwt.js', a=t.getElementsByTagName(n)[0],a.parentNode.insertBefore(u,a))}(window,document,'script'); // Insert Twitter Pixel ID and Standard Event data below twq('init','o31u0'); twq('track','PageView'); }); } </script>  <script type="text/javascript"> window.WPCOM_sharing_counts = {"https:\/\/engineering.fb.com\/2023\/04\/13\/security\/whatsapp-key-transparency\/":20224}; </script> <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KZRLGZ8" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> <noscript><img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=660742068067366&ev=PageView&noscript=1"/></noscript> <script type="text/javascript" id="video-analytics-js-after"> /* <![CDATA[ */ if (window.gdprSafeTrack) { window.gdprSafeTrack(function() { let youtube = document.querySelectorAll('[src*="youtube-nocookie"]'); for (let i = 0; i < youtube.length; i++) { youtube[i].src = youtube[i].src.replace('youtube-nocookie.com', 'youtube.com'); } let vimeo = document.querySelectorAll('[src*="vimeo"]'); for (let i = 0; i < vimeo.length; i++) { vimeo[i].src = vimeo[i].src.replace('&dnt=true', ''); } }); } /* ]]> */ </script> <script type="text/javascript" id="child-understrap-scripts-js-extra"> /* <![CDATA[ */ var loadmore_params = {"restfulURL":"https:\/\/engineering.fb.com\/wp-json\/fb\/v1\/loadmore","searchText":"","posts":"{\"page\":0,\"year\":2023,\"monthnum\":4,\"day\":13,\"name\":\"whatsapp-key-transparency\",\"category_name\":\"security\",\"error\":\"\",\"m\":\"\",\"p\":0,\"post_parent\":\"\",\"subpost\":\"\",\"subpost_id\":\"\",\"attachment\":\"\",\"attachment_id\":0,\"pagename\":\"\",\"page_id\":0,\"second\":\"\",\"minute\":\"\",\"hour\":\"\",\"w\":0,\"tag\":\"\",\"cat\":\"\",\"tag_id\":\"\",\"author\":\"\",\"author_name\":\"\",\"feed\":\"\",\"tb\":\"\",\"paged\":0,\"meta_key\":\"\",\"meta_value\":\"\",\"preview\":\"\",\"s\":\"\",\"sentence\":\"\",\"title\":\"\",\"fields\":\"\",\"menu_order\":\"\",\"embed\":\"\",\"category__in\":[],\"category__not_in\":[],\"category__and\":[],\"post__in\":[],\"post__not_in\":[],\"post_name__in\":[],\"tag__in\":[],\"tag__not_in\":[],\"tag__and\":[],\"tag_slug__in\":[],\"tag_slug__and\":[],\"post_parent__in\":[],\"post_parent__not_in\":[],\"author__in\":[],\"author__not_in\":[],\"search_columns\":[],\"ignore_sticky_posts\":false,\"suppress_filters\":false,\"cache_results\":true,\"update_post_term_cache\":true,\"update_menu_item_cache\":false,\"lazy_load_term_meta\":true,\"update_post_meta_cache\":true,\"post_type\":\"\",\"posts_per_page\":12,\"nopaging\":false,\"comments_per_page\":\"50\",\"no_found_rows\":false,\"order\":\"DESC\"}","current_page":"1","max_page":"0","post_type":"post"}; var search_params = {"ajaxurl":"https:\/\/engineering.fb.com\/wp-admin\/admin-ajax.php","posts":"{\"page\":0,\"year\":2023,\"monthnum\":4,\"day\":13,\"name\":\"whatsapp-key-transparency\",\"category_name\":\"security\",\"error\":\"\",\"m\":\"\",\"p\":0,\"post_parent\":\"\",\"subpost\":\"\",\"subpost_id\":\"\",\"attachment\":\"\",\"attachment_id\":0,\"pagename\":\"\",\"page_id\":0,\"second\":\"\",\"minute\":\"\",\"hour\":\"\",\"w\":0,\"tag\":\"\",\"cat\":\"\",\"tag_id\":\"\",\"author\":\"\",\"author_name\":\"\",\"feed\":\"\",\"tb\":\"\",\"paged\":0,\"meta_key\":\"\",\"meta_value\":\"\",\"preview\":\"\",\"s\":\"\",\"sentence\":\"\",\"title\":\"\",\"fields\":\"\",\"menu_order\":\"\",\"embed\":\"\",\"category__in\":[],\"category__not_in\":[],\"category__and\":[],\"post__in\":[],\"post__not_in\":[],\"post_name__in\":[],\"tag__in\":[],\"tag__not_in\":[],\"tag__and\":[],\"tag_slug__in\":[],\"tag_slug__and\":[],\"post_parent__in\":[],\"post_parent__not_in\":[],\"author__in\":[],\"author__not_in\":[],\"search_columns\":[],\"ignore_sticky_posts\":false,\"suppress_filters\":false,\"cache_results\":true,\"update_post_term_cache\":true,\"update_menu_item_cache\":false,\"lazy_load_term_meta\":true,\"update_post_meta_cache\":true,\"post_type\":\"\",\"posts_per_page\":12,\"nopaging\":false,\"comments_per_page\":\"50\",\"no_found_rows\":false,\"order\":\"DESC\"}","current_page":"1","max_page":"0","article_filter":"364f6d2cc7"}; var more_articles = {"next_article":{"label":"Next","permalink":"https:\/\/engineering.fb.com\/2023\/04\/17\/networking-traffic\/millisampler-network-traffic-analysis\/","title":"A fine-grained network traffic analysis with Millisampler","thumbnail":["https:\/\/engineering.fb.com\/wp-content\/uploads\/2023\/04\/Eng-Blog-Self-Serve-Hero-Images-DATACENTERS-502-TealeLight-x2.jpg?w=580&h=326&crop=1","580","326",true]},"prev_article":{"label":"Prev","permalink":"https:\/\/engineering.fb.com\/2023\/04\/13\/security\/whatsapp-device-verification-protects-your-account\/","title":"How Device Verification protects your WhatsApp account","thumbnail":["https:\/\/engineering.fb.com\/wp-content\/uploads\/2023\/04\/Eng-Blog-Self-Serve-Hero-Images-PRIVACY-103-TealeLight.jpg?w=580&h=326&crop=1","580","326",true]}}; /* ]]> */ </script> <script type="text/javascript" src="https://engineering.fb.com/_static/??/wp-content/themes/code-fb-com/dist/js/child-theme.min.js,/wp-content/themes/code-fb-com/js/prism.js?m=1720616012j" ></script><script type="text/javascript" id="sharing-js-js-extra"> /* <![CDATA[ */ var sharing_js_options = {"lang":"en","counts":"1","is_stats_active":""}; /* ]]> */ </script> <script type="text/javascript" src="https://engineering.fb.com/wp-content/mu-plugins/jetpack-14.2/_inc/build/sharedaddy/sharing.min.js?ver=14.2.1" id="sharing-js-js"></script> <script type="text/javascript" id="sharing-js-js-after"> /* <![CDATA[ */ var windowOpen; ( function () { function matches( el, sel ) { return !! ( el.matches && el.matches( sel ) || el.msMatchesSelector && el.msMatchesSelector( sel ) ); } document.body.addEventListener( 'click', function ( event ) { if ( ! event.target ) { return; } var el; if ( matches( event.target, 'a.share-facebook' ) ) { el = event.target; } else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-facebook' ) ) { el = event.target.parentNode; } if ( el ) { event.preventDefault(); // If there's another sharing window open, close it. if ( typeof windowOpen !== 'undefined' ) { windowOpen.close(); } windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomfacebook', 'menubar=1,resizable=1,width=600,height=400' ); return false; } } ); } )(); var windowOpen; ( function () { function matches( el, sel ) { return !! ( el.matches && el.matches( sel ) || el.msMatchesSelector && el.msMatchesSelector( sel ) ); } document.body.addEventListener( 'click', function ( event ) { if ( ! event.target ) { return; } var el; if ( matches( event.target, 'a.share-x' ) ) { el = event.target; } else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-x' ) ) { el = event.target.parentNode; } if ( el ) { event.preventDefault(); // If there's another sharing window open, close it. if ( typeof windowOpen !== 'undefined' ) { windowOpen.close(); } windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomx', 'menubar=1,resizable=1,width=600,height=350' ); return false; } } ); } )(); var windowOpen; ( function () { function matches( el, sel ) { return !! ( el.matches && el.matches( sel ) || el.msMatchesSelector && el.msMatchesSelector( sel ) ); } document.body.addEventListener( 'click', function ( event ) { if ( ! event.target ) { return; } var el; if ( matches( event.target, 'a.share-linkedin' ) ) { el = event.target; } else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-linkedin' ) ) { el = event.target.parentNode; } if ( el ) { event.preventDefault(); // If there's another sharing window open, close it. if ( typeof windowOpen !== 'undefined' ) { windowOpen.close(); } windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomlinkedin', 'menubar=1,resizable=1,width=580,height=450' ); return false; } } ); } )(); /* ]]> */ </script> </body> </html>