New generation of safe messaging: “Letter Sealing”
by LINE Engineer on 2015.10.13
LINEで送る
Hello, my name is JI and I am working at LINE as a security engineer.
People might have wondered how safe mobile applications are. Message security is surely something most of you have thought about before. As we are centered around mobile messaging, all the engineers at LINE do take extra care to make our app even safer. But when companies are asked about how safe their message transfer process actually is, not many mobile messaging app companies are able to clearly explain about their security.
Today, I proudly present the newest security feature called “Letter Sealing.” A new feature added in version 5.3.0 of LINE.
Safe delivery of messages
Since time immemorial, methods to transfer secrets between one another have existed, and were an important part of human history. People would whisper secrets in dark alleyways or sometimes even devise a code to prevent any potential eavesdroppers from understanding what they were saying.
However, these methods would only work if the speaker and listener were in close proximity. Without the advanced internet technology that lets us easily communicate long-distance, people in the past had to put their messages into envelopes and deliver them by conventional means. Only, there was one problem: the envelope could be intercepted during delivery and resealed once read, unbeknownst to the actual intended recipient. Even when messages were altered or falsified, the recipient had no way of knowing. You can imagine how difficult it must have been for a message to be sent and received safe and sound.
So there was a need for a new method of security. While it may have been impossible to prevent someone from reading the message, people thought of a way to mark the message with a seal that would let the recipient know who wrote the message and if someone had opened the envelope while it was being delivered. This was how sealing became a regular practice. Once the message was inside the envelope, the writer would pour melted wax onto the flaps and push down on the heated wax with a seal engraved with a unique pattern. Anyone attempting to read the message would have had to damage the seal, and the actual recipient would know if the message was compromised by checking if the seal was intact. Unique patterns were engraved onto these seals to prevent anyone from trying to apply a seal of their own after damaging the original. Sometimes, messages were hidden so that they would only be revealed by using a special ink.
[Figure 1] Letter Sealing
Sealing acted as a way of protecting messages from the many problems that may arise while it was being delivered, but the sealing method lost its significance with the waning popularity of hand-written messages. How are messages protected today? What methods are used to keep messages secure on modern communication methods? In the following sections, we will go over how LINE messages are kept secure from prying eyes.
The default encryption method used in LINE
Any modern mobile messaging app or social networking service has servers that store and send message data. Servers decrypt messages or other data that are sent by users and then send them back to the recipient. If the server cannot immediately deliver the data to the recipient, the data will be temporarily stored while the recipient receives a push notification that lets them know there is a new message.
Encryption is a vital piece of technology that keeps a message safe while being delivered from the messaging app to the server. LINE has also encrypted messages so that the various user information sent to the servers cannot be acquired and read by third parties. The process of encrypted communication between the messaging app on user devices and the server looks like [Figure 2] below.
[Figure 2] Current implementation of LINE message delivery
Encryption alone is not the answer. The encryption key required for encrypting and decrypting data cannot be included inside the LINE app. If the key were to be included in the app itself, someone that has access to the same decryption key would be able to view every message that goes through the network. LINE uses a public key encryption method instead.
We include a public key into the LINE app that can encrypt messages, and then create a secure encrypted channel that can only be decrypted by the LINE server when the user device is connected with the servers. This is both a better lightweight solution compared to a secure socket layer (SSL) and provides an encryption method that can be used across all versions of LINE. It additionally eliminates the possibility of a man-in-the-middle (MITM) attack, where someone can snoop on the messages between delivery.
[Figure 3] How RSA is used in LINE
LINE uses the Rivest-Shamir-Adleman (RSA) method of public key encryption, a commonly used cryptosystem in SSLs. How LINE uses RSA will be explained in more