1 research outputs found
Wink: Deniable Secure Messaging
End-to-end encrypted (E2EE) messaging is an essential first step towards
combating increasingly privacy-intrusive laws. Unfortunately, it is vulnerable
to compelled key disclosure -- law-mandated, coerced, or simply by device
compromise. This work introduces Wink, the first plausibly-deniable messaging
system protecting message confidentiality even when users are coerced to hand
over keys/passwords. Wink can surreptitiously inject hidden messages in the
standard random coins (e.g., salt, IVs) used by existing E2EE protocols. It
does so as part of legitimate secure cryptographic functionality deployed
inside widely-available trusted execution environments (TEEs) such as
TrustZone. This provides a powerful mechanism for hidden untraceable
communication using virtually unchanged unsuspecting existing E2EE messaging
apps, as well as strong plausible deniability. Wink has been demonstrated with
multiple existing E2EE applications (including Telegram and Signal) with
minimal (external) instrumentation, negligible overheads, and crucially without
changing on-wire message formats