Analysis Of End-to-end Encryption Algorithm Of Instant Messaging Software Based On Android Reverse Engineering

With the rapid development of mobile communication technology and the popularization of smart mobile terminals,instant messaging software has become an indispensable part of most users' lives and work.Due to the large-scale surveillance activities carried out by intelligence agencies and endless data breaches,many people are using alternative solutions to protect the security and privacy of their communications on the Internet.Therefore,many foreign instant messaging software uses end-to-end encryption algorithm.End-to-end encryption does not use the server to encrypt and decrypt messages,but uses the terminals on both sides of the communication to encrypt or decrypt the messages.The server is only responsible for transmitting the messages,and the communication service provider has no way to view the communication content.Based on the Android reverse engineering analysis technology,this article reverse-engineered the widely used end-to-end encrypted instant messaging application,analyzed how end-to-end encrypted instant messaging software handles messages between users,end-to-end encryption process and security attributes of end-to-end encryption algorithms from a technical perspective.The main work of the thesis is as follows:(1)Research the relevant knowledge and reverse analysis technology under the Android platform,and propose a reverse analysis scheme.The scheme takes the original APK file as a starting point,and reverse process from APK repackaging and re-signing technology,static analysis technology,no source debugging technology,dynamic pile inserting technology this four angles analyze the two code levels(Java layer code and Native layer code)of the Android system.(2)According to the proposed reverse analysis scheme,a reverse analysis system is constructed.The entire reverse system is divided into three modules: static analysis module,dynamic debugging module,and dynamic pile inserting module.The entire system takes the reverse analysis of Java layer code and Native layer code into account,focusing on the analysis of Native layer code.The entire reverse analysis system can obtain function-level data such as function running status,function calling status,register content and so on under the condition of ensuring precision and accuracy,so as to determine the function position and function operation status related to a specific operation and avoid analysis of irrelevant code.(3)Use the reverse analysis system to analyze two commonly used end-to-end encrypted instant messaging software.The two instant messaging software selected for analysis are Signal and Xxxx.Based on the reverse analysis results,the end-to-end encryption process in the application and the situation of keys scheduling are summarized.Through the reverse analysis of the open source software Signal,the feasibility of the reverse analysis scheme was verified,so that the Xxxx can be analyzed more effectively.The end-to-end encryption process of the two instant messaging software includes four stages: registration stage,session establishment stage,asymmetric ratchet update stage,and symmetric ratchet update stage.After four stages of processing,the end-to-end encryption of instant messaging is finally realized.The end-to-end encryption algorithms in both applications mainly include the X3 DH algorithm and the double ratchet encryption algorithm,but the implementation details of the algorithms are different.For the asymmetric ratchet update phase,the Signal application will perform two consecutive ratchet steps after receiving the other party's asymmetric ratchet public key.The first ratchet step is used to update the receiving chain,followed by the second ratchet step used to update the sending chain;while the Xxxx application will only use the asymmetric ratchet to update the receiving session key after receiving the message with asymmetric ratchet,and the sending session key will not be updated until the message receiver becomes the message sender.For the symmetric ratchet update phase,the Signal application uses the key generation chain to derive a symmetric key to update the symmetric ratchet,and the Xxxx application uses two Salsa20 stream encryption algorithms to ensure the privacy of the message plaintext.(4)In order to verify the various security attributes of the end-to-end encryption algorithm,the end-to-end encryption process obtained by reverse analysis is simulated using the pi calculus language,and a series of se curity attributes are verified using the formal verification tool Proverif,such as the privacy of the message,the integrity of the message,the indistinguishability of the message,forward security,future security,identity authentication,replay attack s.The formal verification results show that the end-to-end encryption algorithm in Signal and Xxxx can guarantee the privacy,integrity,forward security,future security of the message and can continue the correct identity authentication while ensuring t he correct initial identity key,but end-to-end encryption algorithms alone cannot guarantee the indistinguishability of messages.