When you send a message through a messaging app, the temptation is to think that “encryption” protects everything. But there is a huge difference between encryption in transit and end-to-end encryption (E2E). In the former, as with HTTPS, the connection is protected between your device and the server, but that server (the company) can read the content. In the latter, the server is just a courier: not even it can open the envelope.
This article explains how that technical achievement is pulled off, hiding a very elegant combination of public-key cryptography, hash functions, and elliptic-curve math.
The problem: agreeing on a key without anyone overhearing
Modern cryptography relies on symmetric encryption: a single secret key encrypts and decrypts the data, using algorithms such as AES-256. The problem is obvious: how do two people who have never met share that key without a third party intercepting it? This is where Diffie-Hellman key exchange (DH) comes in: both parties generate a private number, exchange public values, and through a mathematical calculation each independently arrives at the same shared secret. An attacker who sees the public values cannot reproduce the secret, because at least one private number is missing.
In practice this is done over elliptic curves, with Curve25519 as the standard. It is the same family of math that protects TLS connections, but here every pair of users negotiates its own key.
X3DH: the initial handshake
The protocol used by Signal, WhatsApp and most modern apps is called the Signal Protocol, and its first step is X3DH (Extended Triple Diffie-Hellman). The idea is that each user publishes a set of predefined public keys on the server: a long-term identity key, a signing key, a pre-signing key, and a batch of “one-time” keys. When you want to talk to someone for the first time, you download their keys and combine yours with them into a single shared secret.
The important detail is that three DH exchanges are combined at once, hence the name. The result is a root key from which the first encryption chain is built. Because some of the keys are disposable (one-time prekeys), a compromised message does not reveal the keys of future conversations.
The Double Ratchet: encryption that keeps moving forward
Here is the most ingenious part. If we reused the same key for the whole conversation, one leak would be enough to read everything. The Double Ratchet avoids this by generating a new key for each message, derived from the previous one, using a key derivation function (HKDF).
The name comes from its two “ratchets” (mechanisms that only move forward):
- Symmetric ratchet: each received message advances a counter and derives a new key, so a message’s key is never used for the next one.
- DH ratchet: every so often a fresh DH exchange is performed generating new ephemeral keys, so that even if a session key leaks, the compromise “heals” automatically in the next exchange.
This double mechanism guarantees two properties that cryptographers value highly: forward secrecy —if today’s key is stolen, yesterday’s messages cannot be decrypted— and post-compromise security —if a key leaks, the conversation recovers on its own within a few messages.
Authenticity: making sure the message really is from your friend
Encrypting is not enough; you also have to guarantee that nobody altered or impersonated the message. That is why every message is accompanied by a message authentication code (HMAC), derived from the same session key, which verifies integrity and authenticity. And to prevent a “man in the middle” from impersonating your contact, the first session is usually verified by comparing a fingerprint of the other person’s public key (what WhatsApp shows as a “security code” and Signal as “safety numbers”).
What it protects and what it does not
E2E encryption is extraordinary, but it is worth knowing its limits. It does not hide metadata: who talks to whom, when, and for how long is still visible to the server (only the content is shielded). It also does not protect cloud backups unless they are encrypted with a key only you know, nor forwards when the recipient captures the screen. And it depends on a sound implementation: perfect encryption with poor auditing remains fragile.
Why it matters
In a world where communications pass through dozens of servers and where platforms store years of conversations, end-to-end encryption gives the user back control over their content. The next time you see the padlock in Signal or the “end-to-end encrypted” notice in WhatsApp, you will know that behind it lie elliptic curves, key ratchets, and a constant race between cryptography and those who try to break it.
