darrenchaker Post 6

Given the amount of personal data which is now scanned and available on a computer, I hope laws are enacted to require companies to secure such data via encryption in the event the computer is stolen.

@IceCarver: There is no one more interested in cracking encryption methods than the government. It is not easy to brute-force a good encryption system, even for them with the resources they can muster.

Hackers are using whatever tools and techniques they can develop to get into unencrypted data. They'll try to find or guess the keys required to unlock the data, but they cannot break the encryption itself.

@JoseJames has made some great observations about the consumer market for data encryption but all of these comments neglect to mention the fact that the highest form of data encryption in the world is that used in the military industrial complex.

Tasks including the most secretive intelligence missions to simple messages from family members to service personnel are encrypted when they travel over the military computer networks.

@IceCarver, I can understand your skeptisicsm on the topic of internet data encryption but I think there is some reality that you must bring to your viewpoint.

You are correct in that our dependence on data security is taking a sharp turn upward but this isn't a bad thing as the availability to increase digital information will directly correlate to the spread of knowledge and information.

What you fail to realize is that while there are many maliciously-intended cracking groups attempting to break the latest scheme of data encryption, there is also a bigger and much more significant movement working the legal side of data encryption.

Security firms with the sole business purpose of providing data security

Sure, there are lots of bad people out there but I can assure you that there are a lot more and much higher paid amount of people that make up the good side of data encryption.

@CoffeeJim, I appreciate that you feel so secure with data encryption in this very dangerous digital age but I have some very stark news to add to your reality.

Data encryption in the modern day is very far from safe. While there is a constant battle going on in the cyberspaces there has been a resurgence in the cracking of data encryption algorithms.

It seems that whenever the latest and greatest data security hits the market and touts unbreakable barriers to your data it is only a matter of months or days before illicit groups manage to overcome your thoughts of protection.

Besides the typical impacts of everyday brute force hacking, data decryption efforts by crackers takes a top priority as more and more information becomes available in a digital format.

More and more we will have to rely on the security of these complicated math-based systems and it seems that the battle gets tougher and tougher everyday.

Data encryption is essential to the everyday and highly technology-enhacnced lives that we live.

Most people would disregard computer data encryption as a nerdy endeavor only meant for geeks in big glasses behind bright screens. The truth is that the simplest tasks in our day to day functions require the use of data encryption.

A simple swipe of your debit or credit card at the grocery store will provide you with the reminder that your personal information needs to be protected in a variety of ways that use encryption.

Beyond you simple banking needs there are other uses of data encryption that affect you on a day to day basis. Another example is the use of medical

More and more we are seeing that our precious and private medical records are being digitalized for various reason including the ease of transfer between specialists, reduction of environmental impact and the ability to easily analyze years of data without going through hundreds of papers.

I am especially thankful of data encryption for the safety of my medical records specifically.

The rest is here:
What is Data Encryption? (with picture) - wiseGEEK

In Word 2002 and 2003, the default encryption method is "97/2000 compatible", which means that the same insecure encryption method is used.

Fortunately there is a solution. To achieve good encryption, one has to select a strong encryption method. This is done by clicking the "Advanced" button next to the "Password to open" field. A list of available Crypto Service Providers (CSP's) appears.

Choose encryption type with strong encryption capacity in Word

Here select a CSP with at least 128 bits RC4, like the "Microsoft Enhanced Cryptographic Provider v1.0". 128 bits encryption is considered strong encryption. RC4 is widely used, for example by Online Banking Systems and in PDF encryption.

Let's take the scenario of a cracker trying 15 million passwords per second. This is currently the maximum speed being claimed by password cracker vendors. You need a pretty fast computer to achieve this. The following table shows the computed time to crack a password with 15 million tries per second. Notice the incredible increase in time to try all possible combinations when password length and complexity increase.

Note: the crack times mentioned in the table are needed to try all the possible passwords. There is a great chance that the cracker only needs 50% of this time. Also bear in mind that a cracker can always have a lucky shot at his first try and crack the password immediately. The chance is very small, but theoretically it is possible.

You can open the encrypted document with a standard Word version

Original post:
How safe is Word encryption. Is it really secure?

Here's a demonstration page that uses slowAES.

slowAES was easy to use. Logically designed. Reasonable OO packaging. Supports knobs and levers like IV and Encryption mode. Good compatibility with .NET/C#. The name is tongue-in-cheek; it's called "slow AES" because it's not implemented in C++. But in my tests it was not impractically slow.

It lacks an ECB mode. Also lacks a CTR mode, although you could build one pretty easily given an ECB mode, I guess.

It is solely focused on encryption. A nice complementary class that does RFC2898-compliant password-based key derivation, in Javascript, is available from Anandam. This pair of libraries works well with the analogous .NET classes. Good interop. Though, in contrast to SlowAES, the Javascript PBKDF2 is noticeably slower than the Rfc2898DeriveBytes class when generating keys.

It's not surprising that technically there is good interop, but the key point for me was the model adopted by SlowAES is familiar and easy to use. I found some of the other Javascript libraries for AES to be hard to understand and use. For example, in some of them I couldn't find the place to set the IV, or the mode (CBC, ECB, etc). Things were not where I expected them to be. SlowAES was not like that. The properties were right where I expected them to be. It was easy for me to pick up, having been familiar with the Java and .NET crypto programming models.

Anandam's PBKDF2 was not quite on that level. It supported only a single call to DeriveBytes function, so if you need to derive both a key and an IV from a password, this library won't work, unchanged. Some slight modification, and it is working just fine for that purpose.

EDIT: I put together an example of packaging SlowAES and a modified version of Anandam's PBKDF2 into Windows Script Components. Using this AES with a password-derived key shows good interop with the .NET RijndaelManaged class.

EDIT2: the demo page shows how to use this AES encryption from a web page. Using the same inputs (iv, key, mode, etc) supported in .NET gives you good interop with the .NET Rijndael class. You can do a "view source" to get the javascript for that page.

EDIT3 a late addition: Javascript Cryptography considered harmful. Worth the read.

Read more here:
Javascript AES encryption - Stack Overflow

AES (Rijndael)

The algorithm was invented by Joan Daemen and Vincent Rijmen. The National Institute of Standards and Technology (http://www.nist.gov) has recently selected the algorithm as an Advanced Encryption Standard (AES).

The cipher has a variable block length and key length. Authors of the algorithm currently specify how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128 bits.

BestCrypt uses Rijndael with a 256-bit key in LRW and XTS modes.

To get more information on the algorithm, visit the Rijndael Home Page: http://www.esat.kuleuven.ac.be/~rijmen/rijndael/.

The Blowfish is a fast encryption algorithm designed by Bruce Schneier. Bruce Schneier is well known as the president of Counterpane Systems, a security consulting firm, and the author of Applied Cryptography: Protocols, Algorithms, and Source Code.

The Blowfish encryption algorithm was specially designed to encrypt data on 32-bit microprocessors. Blowfish is significantly faster than DES and GOST when implemented on 32-bit microprocessors, such as the Pentium or Power PC.

The original Blowfish paper was presented at the First Fast Software Encryption workshop in Cambridge, UK (proceedings published by Springer-Verlag, Lecture Notes in Computer Science #809, 1994) and in the April 1994 issue of Dr. Dobbs Journal. In addition, "Blowfish--One Year Later" appeared in the September 1995 issue of Dr. Dobb's Journal.

BestCrypt uses the Blowfish with 448-bit key length, 16 rounds and 128-bit blocks in LRW mode.

Additional information about the Blowfish algorithm is also available on World-Wide-Web at: http://www.counterpane.com/blowfish.html

CAST-128 (described in RFC-2144 document http://www.faqs.org/rfcs/rfc2144.html) is a popular 64-bit block cipher allowing key sizes up to 128 bits. The name CAST stands for Carlisle Adams and Stafford Tavares, the inventors of CAST.

BestCrypt uses CAST with 128-bit key in LRW mode.

The Government Standard of the USSR 28147-89, Cryptographic protection for Data Protection Systems, appears to have played the role in the former Soviet Union (not only in Russia) similar to that played by the US Data Encryption Standard (FIPS 46). When issued, GOST bore the minimal classification 'For Official Use,' but is now said to be widely available in software both in the former Soviet Union and elsewhere. The introduction to GOST 28147-89 contains an intriguing remark that the cryptographic transformation algorithm "does not put any limitations on the secrecy level of the protected information."

The GOST 28147-89 standard includes output feedback and cipher feedback modes of operation, both limited to 64-bit blocks, and a mode for producing message authentication codes. Additional information about the GOST 28147-89 algorithm is also available at the Jetico Web site: http://www.jetico.com/gost.htm

BestCrypt uses GOST 28147-89 with 256-bit key in LRW mode.

RC6 block cipher was designed by Ron Rivest in collaboration with Matt Robshaw, Ray Sidney, and Yiqun Lisa Yin from RSA Laboratories. RSA's RC6 encryption algorithm was selected among the other finalists to become the new federal Advanced Encryption Standard (AES). Visit RSA Laboratories WWW-site (http://www.rsasecurity.com/rsalabs/node.asp?id=2512) to get more information on the algorithm.

BestCrypt uses the RC6 with 256-bit key and 128-bit blocks in LRW and XTS modes.

Serpent is a block cipher developed by Ross Anderson, Eli Biham and Lars Knudsen. Serpent can work with different combinations of key lengths. Serpent was also selected among other five finalists to become the new federal Advanced Encryption Standard (AES).

BestCrypt uses Serpent in LRW and XTS modes with a 256-bit key, 128-bits blocks and 32 rounds.

Additional information about the Serpent algorithm is also available on World-Wide-Web from: http://www.cl.cam.ac.uk/~rja14/serpent.html

The Twofish encryption algorithm was designed by Bruce Schneier, John Kelsey, Chris Hall, Niels Ferguson, David Wagner and Doug Whiting.

Twofish is a symmetric block cipher; a single key is used for encryption and decryption. Twofish has a block size of 128 bits and accepts keys of any length up to 256 bits.

The National Institute of Standards and Technology (NIST) investigated Twofish as one of the candidates for the replacement of the DES encryption algorithm. As the authors of the algorithm state, "we have spent over one thousand hours cryptanalyzing Twofish, and have found no attacks that go anywhere near breaking the full 16-round version of the cipher."

BestCrypt uses a full 16-round version of Twofish and a maximum possible 256-bit encryption key length in LRW and XTS modes.

Additional information about the Twofish algorithm is available also on the World-Wide-Web from: http://www.counterpane.com/twofish.html

Continue reading here:
Encryption Algorithms - Jetico | Encryption Software ...

Description:

Encryption is the process of converting a plaintext message into ciphertext which can be decoded back into the original message. An encryption algorithm along with a key is used in the encryption and decryption of data. There are several types of data encryptions which form the basis of network security. Encryption schemes are based on block or stream ciphers.

The type and length of the keys utilized depend upon the encryption algorithm and the amount of security needed. In conventional symmetric encryption a single key is used. With this key, the sender can encrypt a message and a recipient can decrypt the message but the security of the key becomes problematic. In asymmetric encryption, the encryption key and the decryption key are different. One is a public key by which the sender can encrypt the message and the other is a private key by which a recipient can decrypt the message.

Glossary:

Asymmetric encryption algorithm. A modern branch of cryptography. also known as public-key cryptography in which the algorithms employ a pair of keys (a public key and a private key) and use a different component of the pair for different steps of the algorithm.

Block cipher. These algorithms work on chunks of specific sized data along with a key resulting in blocks of cipher text. The National Institute of Standards and Technology (NIST) is a federal agency that approved the Data Encryption Standard (DES) block cipher an early encryption algorithm created in the mid 1970s. The American National Standards Institute (ANSI) also set this security algorithm as the Data Encryption Algorithm (DEA) standard. Another standard developed in the 1980s is the Triple Data Encryption Standard (3DES). Some commonly used block cipher algorithms are IDEA, RC2, RC5, CAST and Skipjack.

CBC, Cipher Block Chaining. Encryption mode.

CBD, Cipher block chaining mode. The results of the previously chained block is used in the encryption of the next chained block.

CCM, Counter with CBC-MAC. Encryption mode. A generic authenticated encryption block cipher mode. This mode is defined for use with 128-bit block ciphers such as AES.

CFB, Cipher FeedBack. Encryption mode.

Chinese Lottery. A cryptographic approach to cracking encryption algorithms utilizing a large number of machines across the Internet.

Cipher algorithm. A mechanism used to encrypt or decrypt a message.

Ciphertext. The resulting encrypted message produced by a cipher algorithm.

CTR, Counter. Encryption mode.

Decryption. The process of making a encrypted message recognizable with a cipher algorithm.

ECB, Electronic Code Book. Encryption mode.

Encryption. The process of making a message unrecognizable with a cipher algorithm.

Encryption key. A sequence of values that are used with a cipher algorithm to encrypt a message. The choice of random (or cryptographically pseudorandom) keys, a secure key exchange mechanism, frequent key refreshments, and good secrecy protection of keys are all essential ingredients for the security of the integrity verification mechanism.

OFB, Output FeedBack. Encryption mode.

Plaintext. An unencrypted message.

Private key. (RFC 2828) The secret component of a pair of cryptographic keys used for asymmetric cryptography. In a public key cryptosystem that key of a user's key pair which is known only by that user.

Public key A public key which encrypts a message. (RFC 2828) The publicly-discloseable component of a pair of cryptographic keys used for asymmetric cryptography. In a public key cryptosystem, that key of a user's key pair which is publicly known.

Public key encryption. An encryption mechanism where two keys are used. A public key is used to encrypt the message and a secret private key to decrypt the message.

Secret key. A single secret key which is used in conventional symmetric encryption which is used to encrypt and decrypt a message.

SIV, Synthetic Initialization Vector. Block cipher mode of operation. (RFC 5297) SIV takes a key, a plaintext, and multiple variable-length byte strings that will be authenticated but not encrypted. It produces a ciphertext having the same length as the plaintext and a synthetic initialization vector. Depending on how it is used, SIV achieves either the goal of deterministic authenticated encryption or the goal of nonce-based, misuse-resistant authenticated encryption.

Stream cipher. A symmetric encryption algorithm that processes the data a bit or a byte at a time with a key resulting in a randomized ciphertext or plaintext. Some commonly used stream cipher algorithms are RC4 and W7.

Symmetric encryption algorithm. The encryption key and the decryption key are interrelated and may even be the same.

3DES. Block cipher algorithm.

AES, Advanced Encryption Standard. Block cipher algorithm.

ARIA. Block cipher algorithm.

Blowfish. Block cipher algorithm.

Camellia. Block cipher algorithm.

CAST. Block cipher algorithm.

CLEFIA. Block cipher algorithm.

CMAC. Block cipher algorithm.

DES, Data Encryption Standard. Block cipher algorithm.

GOST 28147. Symmetric cipher algorithm.

[RFC 4357] Additional Cryptographic Algorithms for Use with GOST 28147-89, GOST R 34.10-94, GOST R 34.10-2001, and GOST R 34.11-94 Algorithms.

[RFC 4490] Using the GOST 28147-89, GOST R 34.11-94, GOST R 34.10-94, and GOST R 34.10-2001 Algorithms with Cryptographic Message Syntax (CMS).

IDEA, International Data Encryption Algorithm. Block cipher algorithm.

Mars. Block cipher algorithm.

MISTY1. Block cipher algorithm.

Rabbit. Stream cipher algorithm.

RC2. Block cipher algorithm.

RC4. Stream cipher algorithm. A proprietary encryption algorithm available under license from RSA Data Security Inc.

RC5. Block cipher algorithm.

RC6.

Rijndael. Block cipher algorithm. The winning algorithm of the AES competition.

SEED. Block cipher algorithm.

SKIPJACK. Block cipher algorithm.

SOBER. Stream cipher algorithm.

Twofish. Block cipher algorithm.

W7. Stream cipher algorithm. A byte wide, synchronous stream cipher optimized for efficient hardware implementation at very high data rates. It is a symmetric key algorithm supporting key lengths of 128 bits.

RFCs:

[RFC 3766] Determining Strengths For Public Keys Used For Exchanging Symmetric Keys.

[RFC 4107] Guidelines for Cryptographic Key Management.

[RFC 4270] Attacks on Cryptographic Hashes in Internet Protocols.

Publications:

Obsolete RFCs:

See the rest here:
Encryption algorithms - Network Sorcery

Cryptology for Kids

Introduction:

A code is a system of symbols, letters, words, or signals that are used instead of ordinary words and numbers to send messages or store information. A code is used to keep the message short or to keep it secret.

Codes and ciphers are forms of secret communication. A code replaces words, phrases, or sentences with groups of letters or numbers, while a cipher rearranges letters or uses substitutes to disguise the message. This process is called encryption or enciphering. The science that studies such secret communication is calledcryptology.

How is cryptology used?

Secret writing has been employed about as long as writing has existed. Codes have been used throughout history whenever people wanted to keep messages private. Cryptology has long been employed by governments, military, businesses, and organizations to protect their messages. Today, encryption is used to protect storage of data and transactions between computers. Visit this site to learn more: http://www.thunk.com/learn.html

In ancient times when messages were carried by foot for miles, kings and rulers would encrypt the letters they would send to allies. This helped to protect the secrecy of the message in case they were stolen. In early American history, even George Washington sent coded messages to his fellow soldiers. Likewise, the members of the Continental Congress also encoded their documents. When the telegraph was invented, the Morse Code was used to send understandable messages via sound patterns.

Today, computer users encrypt documents, network space, and e-mail messages as a way to protect the confidentiality of their messages. The new types of encryption are very advanced, and sometimes complicated.but, the basic skill remains true to the ancient methods!

Below you will find a collection of links on cryptology use through history.

Morse Code:

o Visit this website to translate (and listen to!) your own message in Morse Code: http://www.soton.ac.uk/~scp93ch/morse/

Navajo Code Talkers in WWII:

o Visit this site to read more about these important Americans and their role in our victory during WWII: http://www.history.navy.mil/faqs/faq61-2.htm

ENIGMA in WWII:

o Learn more about the code machine, ENIGMA, cracked by the Allies in WWII http://www.odci.gov/cia/information/artifacts/enigma.htm

Secret Code Breakers Through History:

o This site http://codebreaker.dids.com/fhistory.htm contains many stories about the role of encryption in history.

Calling all cryptologists!

Your mission (should you choose to accept it) is to encrypt the message the following message using at least 3 different secret codes. Write your responses on a separate piece of paper.

Message to Encrypt:

The red balloon will launch at noon tomorrow. Alert all parties!

Helpful Resources:

The following links will provide you with an assortment of sample encryption techniques. Be sure to explore them all!

Numbers Stand for Letters

o http://www.funology.com/braindrains/bd002.cfm

Cryptographs

o http://www.scouting.org.za/codes/sliding.html

Pigpen Ciphers

o http://www.scouting.org.za/codes/pigpen.html

Mixed Up Alphabet

o http://www.funology.com/braindrains/bd001.cfm

Police Letters Alphabet

o http://www.happychild.org.uk/ifs/00001pla.htm

Morse Code Letters

o http://www.happychild.org.uk/ifs/00003mrs.htm

FUN Cryptology Projects for YOU to Try:

National Security Agencys Code Challenge: Visit this site http://www.nsa.gov/programs/kids/standard/lab/elementary/index.shtml to begin your journey as a secret agent for the federal government. Click on the Start Puzzle button to begin.

Mirror Writing: If you hold up to a mirror something with writing, the writing looks reversed. You can easily write notes and other things to look like mirror writing. Get a sheet of thin white or light colored paper. With a dark marker, write something on one side. Make sure you write it thick and dark enough so that it will show through on to the other side. Flip over the paper and trace what you wrote. You'll be tracing it backwards. It should come out like how you would see your regular writing if you were to hold it up to a mirror. For fun, write down different words, or write a note to someone, then reverse it and send it to them.

Invisible Ink: If you write with white crayon on a white piece of paper, it looks like there's nothing there. But if you then paint over it, your invisible writing will magically appear. Write words, phrases or even a note to someone, and then impress them by making it magically appear!

Cryptograph Wheel: You can make a special Cryptograph Wheel to solve cryptographs (see the picture!) First make two circles of cardboard, one a bit smaller than the other, and use a protractor to mark them off into 26 pieces of about 13.8 degrees each. Write one letter of the alphabet in each division on each wheel. Then attach the two wheels together using a split pin so that you can rotate them independently. Visit this site again to see an example: http://www.scouting.org.za/codes/sliding.html

American Sign Language: Use this site to learn more about signing the alphabet. http://www.mikesart.net/clorisacom/signlanguage/?inputstring=hello You can learn how to spell words. Enter a word into the box and press "translate" to see how it looks in the sign language. Each finger represents a letter.

Pin Marks:

Using a newspaper or a sheet of paper. Use a pin to make tiny holes under specific letters to spell out a secret message. To decipher the message, hold the paper up to a light (or window) and write down the marked letters.

See original here:
Encryption for Kids!

Modern Examples of Symmetric Authenticated Encryption of a string.

The general best practice for symmetric encryption is to use Authenticated Encryption with Associated Data (AEAD), however this isn't a part of the standard .net crypto libraries. So the first example uses AES256 and then HMAC256, a two step Encrypt then MAC, which requires more overhead and more keys.

The second example uses the simpler practice of AES256-GCM using the open source Bouncy Castle (via nuget).

Both examples have a main function that takes secret message string, key(s) and an optional non-secret payload and return and authenticated encrypted string optionally prepended with the non-secret data. Ideally you would use these with 256bit key(s) randomly generated see NewKey().

Both examples also have a helper methods that use a string password to generate the keys. These helper methods are provided as a convenience to match up with other examples, however they are far less secure because the strength of the password is going to be far weaker than a 256 bit key.

Update: Added byte[] overloads, and only the Gist has the full formatting with 4 spaces indent and api docs due to StackOverflow answer limits.

.NET Built-in Encrypt(AES)-Then-MAC(HMAC) [Gist]

Bouncy Castle AES-GCM [Gist]

Read more:
c# - Encrypt and decrypt a string - Stack Overflow

The war on terror has created a privacy vs. security debate across the world including in Europe, where one thing investigators look into is a texting app favored by ISIS

The following script is from "Encryption" which aired on March 13, 2016. Lesley Stahl is the correspondent. Shachar Bar-On, producer.

The argument over encryption between Apple and the FBI reminds us that the world is facing a far more tech-savvy terror threat. While not that long ago al Qaeda often handled its communications by going back to the Stone Age relying on mules and couriers, the Islamic State, or ISIS, proved it can be done with just a push of a button using everyday tools of 21st century teenagers: the latest smartphones and messaging apps.

The encryption debate centers around an iPhone found in San Bernardino, where 14 men and women were killed in a terror attack last December. But before that, there was the massacre in Paris. We went there to meet the city's chief prosecutor who is confronting some of the same issues.

Paris, France

CBS News

Francois Molins: The terrorists are able to communicate with total impunity.

Francois Molins is the head prosecutor of Paris -- he's investigated all the big acts of terrorism here, including Charlie Hebdo, the kosher supermarket, and now the November 13 attacks where 130 people were killed, more than 350 wounded.

Lesley Stahl: Do you have phones in terrorist attacks that you have not been able to get into because of encryption?

Francois Molins: Oui oui. With all these encryption software programs, we can't penetrate into certain conversations and we're dealing with this gigantic black hole, a dark zone where there are just so many dangerous things going on.

Play Video

Rob Wainwright, the head of Europol, saysISIS has developed "an external command force" to carry Special Forces-style attacks on the West

It's not just phones. One of the things he's looking into is a texting app favored by ISIS called Telegram which, like the new Apple iPhone -- offers advanced encryption.

Lesley Stahl: How often have you run in, in all your investigations, into Telegram?

Francois Molins: Yes, very often. Telegram, we can't penetrate, we can't get into it.

Pavel Durov is the inventor of Telegram. He's a young man without a country. He's Russian born but wanders the world now, in exile. He created Telegram so he could communicate in complete secrecy. It has taken off, used by over 100 million people.

Lesley Stahl with Telegram inventor Pavel Durov

CBS News

Lesley Stahl: But it's also used by terrorists now. Is this a concern for you?

Pavel Durov: Oh definitely. And in our 100 million users, probably this illegal activity we're discussing are only a fraction of a fraction of a fraction of the potential usage. And still we're trying to, you know, prevent it.

Telegram has become a go-to site for ISIS. They use it to widely disseminate propaganda like this video of the Paris attackers training in Syria. But ISIS fighters can also use Telegram to send private messages to each other to covertly plan and coordinate attacks.

Lesley Stahl: Is there something on your site on Telegram that allows any messages, emails, to just disappear, vanish?

Pavel Durov: Yes. So in private messages we have this secret chat feature which provides you with a self-destruct timer.

Lesley Stahl: Self-destruct timer.

Pavel Durov: You could set a specific amount of time, like a few seconds, or a minute or a week, after which the message would disappear.

Durov's obsession with secrecy and security stems from his own personal history. Long before Telegram he was known as the Mark Zuckerberg of Russia because he built a popular equivalent of Facebook. But in 2011, when anti-Putin marchers filled Moscow's streets, the Kremlin demanded he take down the organizers' sites.

Play Video

Pavel Durov, the founder and CEO of Telegram, tells 60 Minutes that Snowden's revelations "shattered" his view of the West

Pavel Durov: And I refused to do that publicly. And the next day I had armed policemen at my doorstep...

Lesley Stahl: Wonder why.

Pavel Durov: ...and tried to break into my apartment.

There was continual pressure on him to hand over users' personal data culminating in 2014 when, under Kremlin duress, Durov was ousted from his own company.

Lesley Stahl: How long did you stay in Russia after that?

Pavel Durov: Not a single day.

Lesley Stahl: Oh, then you fled.

Pavel Durov: I certainly feel that I am not welcome at that country anymore.

That's when he created Telegram and encrypted it, he says, so activists could be assured that no government could ever access their personal data. He managed to leave Russia with a reported $300 million which he uses to singled-handedly fund Telegram, costing him, he says, over a million dollars a month.

Lesley Stahl: This was something that you created to allow democracy to flourish, to allow dissidents in Russia and in other countries to communicate with each other. And then all of a sudden you find out that this terrorist group uses your site for completely different reasons.

Pavel Durov: Yeah, we were horrified.

Lesley Stahl: There's an irony there.

Pavel Durov: There is. But you know there's little you can do because if you allow this tool to be used for good, there will always be some people who would misuse it.

Just hours after the terrorists hit Paris on the night of November 13, ISIS used Telegram to take credit for the attacks. It was a wake-up call for European authorities.

Rob Wainwright: It's the first time ever in Europe that we had terrorists rampaging through our streets. First time we had terrorists wearing suicide belts in heavily populated, public areas.

As head of Europol, Rob Wainwright gathers and analyzes information from over 600 law enforcement agencies. He has set up a new counter terrorism center to better coordinate all the intelligence.

Lesley Stahl: How much is encryption a problem generally in these investigations?

Rob Wainwright: In most of them. I mean, across the tens of thousands of investigations that Europol is supporting every year on terrorism and serious crime, at least three quarters of them have encryption at the heart of the challenge that law enforcement face.

Lesley Stahl: Now, what about the November 13th attack specifically?

Rob Wainwright: From what we see, encryption also played a role in that part and that's something that we we're digging into much deeper at the moment.

Lesley Stahl: Why is it still a mystery?

Rob Wainwright: It's not-- not so much of a mystery. It's not that I can share all the details about a very sensitive investigation in public.

We know that the ringleader of the attack, 28-year-old Abdelhamid Abaaoud, was a wanted fugitive who goaded authorities by bragging in this online ISIS magazine how easily he eluded them shuttling between Europe and Syria. He liked taking selfies of his exploits, often posting them online. In this gruesome video, he and his friends tie bodies to the back of a truck, Abaaoud in the driver's seat:

[Abdelhamid Abaaoud (translator): We used to tow jet skis - now we tow the infidels fighting us.]

Lesley Stahl: What is astonishing is that you knew who he was. He was on everybody's radar screen.

Francois Molins (translator): You're right. Abaaoud-- he has been one of the major targets for France and Belgium counterterrorism for many months.

Before Paris, Abaaoud was suspected of guiding European jihadis in attacks in France and Belgium, but the attempts were all foiled. In one of them an iPhone belonging to one of the jihadis was confiscated but it was not useful in finding Abaaoud, because it was encrypted.

Lesley Stahl: We've been told, and I want to confirm it, that the encrypted phone may have prevented you from getting information about the Paris attacks.

Francois Molins (translator): That's a theory that really needs to be looked into, but to do so, we really need to be able to get into that phone. You know, I say, all these smart phones make justice blind because they deprive us of a lot of information that could contribute to our investigations.

Abaaoud was on site in Paris on the night of November 13, coordinating three different teams over his phone: one group, at a soccer stadium, exploded their suicide vests outside. Abaaoud and two others went on a killing spree at bars and cafes... while a third team stormed a rock-concert at the Bataclan theater and started shooting.

Francois Molins (translator): I said to myself: "The thing that we'd been fearing was coming for months, was now happening."

The prosecutor rushed to the scene - first to the cafes where Abaaoud had already sprayed the sites with an assault rifle.

Francois Molins (translator): We know that he participated in the commando attacks at the cafes. Afterwards we see him in a video in the Paris subway. And we do believe that he went maybe just in front of the Bataclan.

The prosecutor also went from the cafes to the Bataclan. What he didn't know was that Abaaoud was outside the theater at the same time, amid throngs of police, standing there in his orange sneakers - apparently talking on the phone to the shooters inside. While police didn't spot him there, he was tracked down to an apartment in a Paris suburb five days later, and killed in a hail of gunfire and explosions.

In a stroke of luck police found a Samsung phone one of the attackers had tossed into a garbage can in front of the Bataclan, and it posed no encryption problems.

Francois Molins (translator): We were able to get information from phone communications that enabled us to retrace the terrorists movements: where they were, where they stayed, their itineraries.

Standard text messages were found on the phone including a final one saying, "Here we go. We're starting!" Also found, the app Telegram. It had been downloaded the day of the attack.

Lesley Stahl: But you personally don't know if the attackers actually communicated via Telegram to plot these coordinated attacks, or even if they used it during the attacks?

Pavel Durov: No, we have no information to prove that.

Lesley Stahl: Is there anything in your mind that says, "Gee, we have to have - to allow law enforcement to get in because what's going on is just unacceptable.

Pavel Durov: You know the interesting thing about encryption is that it cannot be secure just for some people.

Lesley Stahl: ISIS and other terrorist groups, they just push a button on an application like yours, specifically yours, an application... and it's gone around the world, like that.

Pavel Durov: Well again, this is the world of technology and it's impossible to stop them at this point. ISIS could come up with their own messaging solution within a month or so, if they wanted to because the--

Lesley Stahl: You mean create their own Telegram?

Pavel Durov: Exactly.

Since Paris, Durov has been purging ISIS propaganda from Telegram but says, if asked to unlock any private messages, he would tell the authorities that the encryption code makes it mathematically impossible, using a similar argument as Apple.

Lesley Stahl: So you're basically saying that even if you wanted to, your hands are tied.

Pavel Durov: Yes.

Lesley Stahl: You can't do it.

Pavel Durov: We cannot.

Lesley Stahl: So this is one of the great debates of our time. Which is more important? Is it more important to shut down this kind of terrorism or preserve privacy?

Pavel Durov: I'm personally for the privacy side. But one thing that should be clear is that you cannot make just one exception for law enforcement without endangering private communications of hundreds of millions of people because encryption is either secure or not.

Lesley Stahl: The founder of Telegram has told us, he thinks privacy is more important than security issues, and he wouldn't open it up even if you did ask him.

Francois Molins (translator): Fine, that's his personal choice. But I consider that there are limits in all societies. There are limits to freedom and privacy. Freedom doesn't mean you can just do anything and everything you want. And there's a duty of institutions -- police and judicial -- to ensure security. You can't have freedom without security.

2016 CBS Interactive Inc. All Rights Reserved.

Go here to see the original:
The Encryption Debate - CBS News

1. What is an encryption registration? How long does it take to receive a response from BIS for my encryption registration?

2. Who is required to submit an Encryption Registration, classification request or self-classification report?

3. What are my responsibilities for exporting or re-exporting encryption products where I am not the producer?

4. What should I do if I cannot obtain the encryption registration Number (ERN) or the Export Control Classification Number (ECCN) for the item from the producer or manufacturer?

5. Can a third-party applicant submit an encryption registration and self-classification report on my behalf?

6. How do I report exports and reexports of items with encryption?

7. Can I export encryption technology under License Exception ENC?

8. What is non-standard cryptography?

9. How do I complete Supplement No. 5 if I am a law firm or consultant filing on behalf of a producer of encryption items?

10. What if you are not the producer of the item or filing directly on behalf of the producer (e.g., law firm/consultant)?

11. What do I need to submit with an encryption commodity classification request in SNAP-R?

12. Is Supplement No. 6 to Part 742 required for obtaining paragraph 740.17(b)(1) authorization?

13. How do I submit a Supplement No. 8 Self-Classification Report for Encryption Items?

14. When do I file Supplement No. 8 Self-Classification Report for Encryption Items?

15. What is Note 4?

16. I have an item that was reviewed and classified by BIS and made eligible for export under paragraph (b)(3) of License Exception ENC in 2009. The encryption functionality of the item has not changed. This item is now eligible for self-classification under paragraph (b)(1) of License Exception ENC. What are my responsibilities under the new rule?

17. When do I need a deemed export license for encryption technology and source code?

18. Does the EAR definition of "OAM" include using encryption in performing network security monitoring functions?

1. What is an Encryption Registration? How long does it take to receive a response from BIS for my Encryption Registration?

Encryption registration is a prescribed set of information about a manufacturer and/or exporter of certain encryption items that must be submitted to the Bureau of Industry and Security as a condition of the authorization to export such items under License Exception ENC or as mass market items.

Advance encryption registration is required for exports and reexports of items described in paragraphs 740.17(b)(1), (b)(2), and (b)(3) and paragraphs 742.15(b)(1), and (b)(3) of the Export Administration Regulations (EAR). Registration is made through SNAP-R by submitting the questionnaire set forth in Supplement No. 5 to part 742 of the EAR (point of contact/company overview/types of products/ etc.). Registration of a manufacturer authorizes the manufacturer as well as other parties to export and reexport the manufacturers encryption products that the manufacturer has either self-classified or has had the items classified by BIS, pursuant to the provisions referenced above. A condition of the authorization is that the manufacturer must submit an annual self-classification report for relevant encryption items.

How long does it take to receive a response from BIS for my encryption registration?

Once you have properly registered with BIS, the SNAP-R system will automatically issue an Encryption Registration Number (ERN), e.g., R123456, upon submission of a request. BIS estimates that the entire registration procedure should take no more than 30 minutes.

2. Who is required to submit an encryption registration, classification request or self-classification report?

Any party who exports certain U.S.-origin encryption products may be required to submit an encryption registration, classification request and/or self-classification report; however, if a manufacturer has registered and has self-classified relevant items and/or had items classified by BIS, and has made the classifications available to other parties such as resellers and other exporters/reexporters, such other parties are not required to register, to submit a classification request, or to submit an annual self-classification report.

3. What are my responsibilities for exporting or re-exporting encryption products where I am not the product manufacturer?

Exporters or reexporters that are not producers of the encryption item can rely on the Encryption Registration Number (ERN), self-classification report or CCATS that is published by the producer when exporting or reexporting the registered and/or classified encryption item. Separate encryption registration, commodity classification request or self-classification report to BIS is NOT required.

Please continue to the next question if the information is not available from the producer or manufacturer.

4. What should I do if I cannot obtain the Encryption Registration Number (ERN) or the Export Control Classification Number (ECCN) for the item from the producer or manufacturer?

If you are not the producer and are unable to obtain the producers information or if the producer has not submitted an encryption registration, self-classification report or commodity classification for his/her products to BIS, then you must register with BIS. The registration process will require you to submit a properly completed Supplement No. 5 to part 742 and subsequent Supplement No. 8 Self Classification Report for the products. You will receive an ERN for the registered products or CCATSs as appropriate. BIS recognizes that non-producers who need to submit for encryption registration may not have all of the information necessary to complete Supplement No. 5 to part 742. Therefore, special instructions have been included in Supplement No. 5 to account for this situation.

For items described in Part 740.17(b)(2) and (b)(3) or Part 742.15(b)(3) that require the classification by BIS, the non-producer is required to submit as much of the technical information required in Supplement No. 6 to part 742 - Technical Questionnaire for Encryption Items as possible.

5. Can a third-party applicant submit an encryption registration and self-classification report on my behalf?

Yes, special instructions for this purpose are provided in paragraph (r) of Supplement No. 2 to part 748 of the EAR for this purpose. The information in block 14 (applicant) of the encryption registration screen and the information in Supplement No. 5 to part 742 must pertain to the company that seeks authorization to export and reexport encryption items that are within the scope of this rule. An agent for the exporter, such as a law firm, should not list his/her name in block 14. The agent however may submit the encryption registration and list himself/herself in block 15 (other party authorized to receive license) of the encryption registration screen in SNAP-R.

6. How do I report exports and reexports of items with encryption?

All reports (i.e., the semi-annual sales report and the annual self-classification report) must be submitted to both BIS and the ENC Encryption Request Coordinator.

An annual self-classification report is required for producers of encryption items described by paragraphs 740.17(b)(1) and 742.15(b)(1) of the EAR. The information required and instruction for this report is provided in Supplement No. 8 to Part 742-Self-Classification Report for Encryption Items. Reports are submitted to BIS and the Encryption Request Coordinator in February of each year for items exported or reexported during the previous calendar year (i.e., January 1 through December 31) pursuant to the encryption registration and applicable sections740.17(b)(1) or 742.15(b)(1) of the EAR. Annual self-classification reports are to be submitted to This email address is being protected from spambots. You need JavaScript enabled to view it. and This email address is being protected from spambots. You need JavaScript enabled to view it..

Semi-annual sales reporting is required for exports to all destinations other than Canada, and for reexports from Canada for items described under paragraphs (b)(2) and (b)(3)(iii) of section 740.17. Paragraph 740.17(e)(1(iii) contains certain exclusions from this reporting requirement. Paragraphs 740.17(e)(1)(i) and (e)(1)(ii) contains the information required and instructions for submitted the semi-annual sales reports. The first report is due no later than August 1 for sales occurring between January 1 and June 30 of the year, and the second report is due no later than February of the following year for sales occurring between July 1 and December 31 of the year. Semi-annual sales reports continue to be submitted to: This email address is being protected from spambots. You need JavaScript enabled to view it. and This email address is being protected from spambots. You need JavaScript enabled to view it..

7. Can I export encryption technology under License Exception ENC?

Yes, License Exception ENC is available for transfer of encryption technology. Specifically, paragraph 740.17(b)(2)(iv) has been amended to permit exports and reexports of encryption technology as follows:

(A) Technology for "non-standard cryptography". Encryption technology classified under ECCN 5E002 for "non-standard cryptography", to any end-user located or headquartered in a country listed in Supplement No. 3 to this part;

(B) Other technology. Encryption technology classified under ECCN 5E002 except technology for "cryptanalytic items", "non-standard cryptography" or any "open cryptographic interface," to any non-"government end-user" located in a country not listed in Country Group D:1 or E:1 of Supplement No. 1 to part 740 of the EAR.

8. What is non-standard cryptography?

Non-standard cryptography, defined in Part 772 Definition of Terms, means any implementation of cryptography involving the incorporation or use of proprietary or unpublished cryptographic functionality, including encryption algorithms or protocols that have not been adopted or approved by a duly recognized international standards body (e.g., IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, and GSMA) and have not otherwise been published.

9. How do I complete Supplement No. 5 if I am a law firm or consultant filing on behalf of a producer or exporter of encryption items?

The information in Supplement No. 5 to Part 742must pertain to the registered company, not to the submitter. Specifically, the point of contact information must be for the registered company, not a law firm or consultant filing on behalf of the registered company.

10. What if you are not the producer of the item or filing directly on behalf of the producer (e.g., law firm/consultant)?

You may answer questions 4 and 7 in Supplement No. 5 to part 742as not applicable if your company is not the producer of the encryption item. An answer must be give for all other questions. An explanation is required when you are unsure.

11. What do I need to submit with an encryption commodity classification request in SNAP-R?

Encryption commodity classification determinations should be submitted through SNAP-R. Before entering SNAP-R, you should prepare the following supporting documents:

After accessing SNAP-R, fill-in a commodity classification determination request and upload the supporting documents into SNAP-R.

12. Is Supplement No. 6 to part 742 required for paragraph 740.17(b)(1) authorization?

If you are requesting a classification of an item is described in paragraph 740.17(b)(1) (in other words, the item is not described in either Section 740.17(b)(2) or (b)(3)), a Supplement No. 6questionnaire is not required as a supporting document. Provide sufficient information about the item (e.g., technical data sheet and/or other explanation in a separate letter of explanation) for BIS to determine that the item is described in paragraph 740.17(b)(1). If you are not sure that your product is authorized as 740.17(b)(1) and you want BIS to confirm that it is authorized under 740.17(b)(1), providing answers to the questions set forth in Supplement No. 6 to part 742 with your request should provide BIS with sufficient information to make this determination.

13. How do I submit a Supplement No. 8 Self Classification Report for Encryption Items?

The annual self-classification report must be submitted as an attachment to an e-mail to BIS and the ENC Encryption Request Coordinator. Reports to BIS must be submitted to a newly created e-mail address for these reports (This email address is being protected from spambots. You need JavaScript enabled to view it.). Reports to the ENC Encryption Request Coordinator must be submitted to its existing e-mail address (This email address is being protected from spambots. You need JavaScript enabled to view it.). The information in the report must be provided in tabular or spreadsheet form, as an electronic file in comma separated values format (CSV), only. In lieu of email, submissions of disks and CDs may be mailed to BIS and the ENC Encryption Request Coordinator.

14. When do I file Supplement No. 8 Self-Classification Report for Encryption Items?

An annual self-classification report for applicable encryption commodities, software and components exported or reexported during a calendar year (January 1 through December 31) must be received by BIS and the ENC Encryption Request Coordinator no later than February 1 the following year. If no information has changed since the previous report, an email must be sent stating that nothing has changed since the previous report or a copy of the previously submitted report must be submitted.

15. What is Note 4?

Note 4 to Category 5, Part 2 in the Commerce Control List (Supplement No. 1 to part 774) excludes an item that incorporates or uses cryptography from Category 5, Part 2 controls if the items primary function or set of functions is not information security, computing, communications, storing information, or networking, andif the cryptographic functionality is limited to supporting such primary function or set of functions. The primary function is the obvious, or main, purpose of the item. It is the function which is not there to support other functions. The communications and information storage primary function does not include items that support entertainment, mass commercial broadcasts, digital rights management or medical records management.

Examples of items that are excluded from Category 5, Part 2 by Note 4 include, but are not limited to, the following:

16. I have an item that was reviewed and classified by BIS and made eligible for export under paragraph (b)(3) of License Exception ENC in 2009. The encryption functionality of the item has not changed. This item is now eligible for self-classification under paragraph (b)(1) of License Exception ENC. What are my responsibilities under the new rule?

Your item meets the grandfathering provisions set forth in section 740.17(f)(1) of the EAR. You do not need to submit an encryption registration (Supplement No. 5), an annual self-classification report (Supplement No. 8), or semi-annual sales reports for the item.

17. When do I need a deemed export license for encryption technology and source code?

A license may be required in certain circumstances for both deemed exports and deemed reexports. For encryption items, the deemed export rules apply only to deemed exports of technology and to deemed reexports of technology and source code. There are no deemed export rules for transfers of encryption source code to foreign nationals in the United States. This is because of the way that section 734.2 defines exports and reexports for encryption items.

For transfers of encryption technology within the United States, section 740.17(a)(2) of license exception ENC authorizes the export and reexport of encryption technology by a U.S. company and its subsidiaries to foreign nationals who are employees, contractors, or interns of a U.S. company . . . There is no definition of U.S. company in the EAR, however, BIS has interpreted this to apply to any company operating in the United States. This means that deemed export licenses are generally not required for the transfer of encryption technology by a company in the U.S. to its foreign national employees. A deemed export license may be required if, for example, a company operating in the U.S. were to transfer encryption technology to a foreign national who is not an employee, contractor, or intern of a company in the United States. License exception ENC does not authorize deemed exports or reexports to any national of a country listed in Country Group E:1.

For deemed reexports, the end-user would have to be an employee, contractor, or intern of a U.S. Subsidiary for 740.17(a)(2) to apply, or a private sector end-user headquartered in a Supplement 3 country for 740.17(a)(1) to apply. The term contractor in this context means a contract employee (i.e., a human person). License exception ENC does not authorize deemed exports or reexports to any national of a country listed in Country Group E:1.

Also note that as of June 25, 2010, encryption technology (except technology for cryptanalytic items, Open Cryptographic Interface items, and non-standard cryptography) that has been reviewed is eligible for license exception ENC to any non-government end user located outside of Country Group D:1. Also, encryption source code that has been reviewed by BIS and made eligible for license exception ENC under 740.17(b)(2) is eligible for export and reexport to any non-government end-user. Thus encryption technology and source code that have been reviewed are eligible for export and reexport to a broader range of end-users than 740.17(a) allows. Again, section 740.17 does not authorize deemed exports or reexports to any national of a country listed in Country Group E:1.

18. Does the EAR definition of "OAM" include using encryption in performing network security monitoring functions?

No. The definition of "OAM" includes "monitoring or managing the operating condition or performance of an item." BIS does not consider network security monitoring or network forensics functions to be part of monitoring or managing operating condition or performance.

The phrase "monitoring or managing the operating condition or performance of an item" is meant to include all the activities associated with keeping a computer or network-capable device in proper operating condition, including: configuring the item; checking or updating its software; monitoring device error or fault indicators; testing, diagnosing or troubleshooting the item; measuring bandwidth, speed, available storage (e.g. free disk space) and processor / memory / power utilization; logging uptime / downtime; and capturing or measuring quality of service (QoS) indicators and Service Level Agreement-related data.

However, the "OAM" definition does not apply to cryptographic functions performed on the forwarding or data plane, such as: decrypting network traffic to reveal or analyze content (e.g., packet inspection and IP proxy services); encrypting cybersecurity-relevant data (e.g., activity signatures, indicators or event data extracted from monitored network traffic) over the forwarding plane; or securing the re-transmission of captured network activity.

Thus, products that use encryption for such network security monitoring or forensics operations, or to provision these cryptographic services, would not be released by the OAM decontrol notes (l) or (m), or the Note to 5D002.c.

Similarly, the "OAM" decontrol does not apply to security operations directed against data traversing the network, such as capturing, profiling, tracking or mapping potentially malicious network activity, or "hacking back" against such activity.

Back to top

See the original post:
Encryption FAQs - Bureau of Industry and Security

The Facebook-owned app announced Tuesday that it has added full end-to-end encryption for all communications. That means all text messages, file transfers and voice calls are scrambled en route between users' phones so they can't be intercepted.

The news comes after the bitter public fight between the FBI and Apple over encryption. WhatsApp says its latest move makes it impossible for third parties -- including government agencies, criminals and the company itself -- to peek into users' conversations within the service.

"The desire to protect people's private communication is one of the core beliefs we have at WhatsApp, and for me, it's personal," said Jan Koum, one of the app's founders who was raised in Ukraine under Soviet rule.

"The fact that people couldn't speak freely is one of the reasons my family moved to the United States," he said in a statement.

WhatsApp started introducing end-to-end encryption in 2014, but it's taken until now to extend it to all communications across all devices. Users need to be using the latest version of the app to ensure they benefit from the measure, it said.

Amnesty International called WhatsApp's move a "huge victory" for free speech.

Related: Facebook and WhatsApp might be the next in encryption fight

"Every day we see stories about sensitive records being improperly accessed or stolen. And if nothing is done, more of people's digital information and communication will be vulnerable to attack in the years to come," the WhatsApp statement said. "Fortunately, end-to-end encryption protects us from these vulnerabilities."

By bringing it to the entirety of its vast user base, WhatsApp has made the technology the most widely used cryptographic tool on the planet.

Encryption has become a hot-button issue around the globe. The feud between Apple and the FBI fueled a fierce debate over the tradeoff between individuals' privacy and the demands of law enforcement.

The U.S. Department of Justice asked the tech giant to unlock the iPhone of one of the terrorists involved in the San Bernardino shootings in December.

Apple refused the request and fought a court order ordering it to comply. The company said the demand would force it to create a "backdoor" that could potentially allow the government or hackers break into similar iPhones.

Related: Cellebrite is the FBI's go-to phone hacker

The FBI eventually dropped the case after it managed to get into the iPhone with the help of an unidentified third party. But Apple is opposing similar demands by U.S. federal law enforcement in at least a dozen other active cases.

WhatsApp filed an amicus brief in support of Apple's stance, as did several other major tech firms including Google.

The push to introduce end-to-end encryption has brought the app into conflict with law enforcement.

Brazilian authorities have demanded WhatsApp hand over IP addresses, customer information, geo-location data and messages related to an ongoing drug trafficking case.

WhatsApp says it has been cooperating, but is not able to provide "the full extent of the information law enforcement is looking for" because of the encryption it had already implemented.

A Brazilian judge ordered the service blocked countrywide in December after WhatsApp failed to respond to court orders. The ruling cut off all 100 million Brazilian WhatsApp users for 48 hours before a senior judge overturned it.

CNNMoney (Hong Kong) First published April 5, 2016: 11:59 PM ET

Read this article:
WhatsApp adds end-to-end encryption for all communications ...