Between Bits and Values: The Ethical Debate Around End-to-End Encryption

 What is end-to-end encryption and why is it important?

Over the last decade, information security has been gaining greater importance and awareness, where one of the aspects of security has been to converse privately, evolving archaic systems for transmitting clear information through sophisticated encryption mechanisms. end to end. 

End-to-end encryption (E2EE – End to End Ecryption) is a computer security mechanism that guarantees the confidentiality and integrity of data in a communication between two parties through a channel potentially insecure. It consists of encrypting the data at the source end and decrypting it at the destination (client-client) without this being done on the service provider's server, ensuring that a third party cannot intercept the data in the clear without the relevant decryption key. The asymmetric key pair [1], is generated between the sender and the recipient, which implies that only these two parties They have access to the keys necessary to decrypt the data. Therefore, the loss of the key pair would prevent access to the transmitted messages.

A practical example is found in instant messaging applications such as Signal, an open source project that uses robust Extended Triple Diffie-Hellman encryption [2] or Post-Quantum Extended Diffie-Hellman [3] proof of quantum computers. This guarantees privacy from a technological point of view, the only data linked to which is the telephone number. Although it may seem like an ideal application from a privacy point of view, its main disadvantage is its limited use. Other well-known applications such as WhatsApp are also based on the same scheme [4], where the privacy of conversations remains intact (as long as you have not been reported by a user [5]). In contrast, the large amount of other unencrypted user data and metadata collected on its servers could endanger privacy [6].

Another architecture opposite to end-to-end encryption is data-in-transit encryption, which consists of encrypting the message at the sending end, decrypting it at the server, encrypting it again at the server and finally decrypting it at the receiving end (client-server-client). . Like the previous one, it protects the information during its transmission, but allows the intermediary server to make use of the transmitted messages [7].

An example of this architecture is the Telegram application, where private messages use the cloud to host and process the transmitted data. However, the application also offers the option to encrypt communication end-to-end using 'secret messages' [8].

Taking into account the rise of E2EE encryption not only in the field of instant messaging with very common basic functions among them, but also in email, video conferencing or others, there is a tipping point where users with fraudulent intentions could take advantage of the advantages of technology to transmit illegal content without being detected. So much so, that government institutions could implement restrictions on the use of end-to-end protocols [9]  by being hindered in the massive control of illicit content through keywords or other methods, as happened in 1993 with Phil Zimmermann [10] under investigation for having published PGP (Pretty Good Privacy i>). One possible measure could be to force technology companies to implement control mechanisms or content scans at each end before encryption and broadcast to the receiver, leaving the main feature of the protocol unusable.