International Association
for Cryptologic Research

Deployment of end-to-end encryption (E2EE) has improved the confidentiality and the integrity of data in various contexts, including messaging, cloud storage, and other web applications. E2EE protocols, such as messaging and file storage, have been studied extensively, instilling confidence in their security. Consequently, there has been a meteoric rise in the adoption of these tools, and E2EE is now a core component of complex systems that impact billions of users. As these applications evolve into intricate, feature-rich ecosystems, our understanding of their security becomes increasingly opaque, and whether the strong security guarantees of the underlying E2EE protocols extend to the broader systems is unclear. As such, a new line of work has analyzed the security of various deployed E2EE applications, finding numerous attacks and proposing mitigations. The purpose of this talk is to bring attention to an emerging threat model for E2EE applications, and motivate future work within the cryptography community. At a high-level, our threat model considers an adversary that simply sends chosen payloads to a victim client, and subsequently observes the encrypted application state. We refer to attacks in this setting as injection attacks. The core of our presentation will consist of an overview of this threat model, highlighting a common root cause of injection attacks. Then, we will present concrete vulnerabilities uncovered in real-world systems across two application domains: backups of messaging applications (based on a recent paper that we will present at S&P ‘24), and password managers (based on ongoing work, which will be made public after we finish the disclosure process). Lastly, we conclude with some general takeaways and directions for future work.