Google Online Security Blog: End-to-end encryption for push messaging, simplified

Security Blog

The latest news and insights from Google on security and safety on the Internet

End-to-end encryption for push messaging, simplified

2018年6月5日

[Cross-posted from the Android Developers Blog]adviseCapillary open source libraryFile-Based EncryptionAndroid Keystoreuser authentication

Crypto functionality and key management across all versions of Android back to KitKat (API level 19).

Key generation and registration workflows.

Message encryption (on the server) and decryption (on the client).

Integrity protection to prevent message modification.

Caching of messages received in unauthenticated contexts to be decrypted and displayed upon device unlock.

Edge-cases, such as users adding/resetting device lock after installing the app, users resetting app storage, etc.

Web Push encryption What it's not

The open source library and demo app are not designed to support peer-to-peer messaging and key exchange. They are designed for developers to send E2E-encrypted push messages from a server to one or more devices. You can protect messages between the developer's server and the destination device, but not directly between devices.

It is not a comprehensive server-side solution. While core crypto functionality is provided, developers will need to adapt parts of the sample server-side code that are specific to their architecture (for example, message composition, database storage for public keys, etc.)