Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Zoom to Provide Detailed Info on Upcoming End-to-End Encryption Feature

Zoom announced this week that on May 22 it will publish a detailed draft of the cryptographic design it plans on using for its upcoming end-to-end encryption feature.

Zoom announced this week that on May 22 it will publish a detailed draft of the cryptographic design it plans on using for its upcoming end-to-end encryption feature.

As a result of increased scrutiny from privacy and security experts — as well as hackers targeting meetings — Zoom has started making improvements to its platform and it has promised to implement changes and new features that would significantly enhance security and privacy.

After it was pointed out that Zoom is not offering true end-to-end encryption and the encryption that is available isn’t the best, the company has promised to work on providing better encryption.

Zoom plans on rolling out AES 256-bit GCM encryption on May 30, but the company also plans on implementing true end-to-end encryption in the near future, for which it recently acquired secure messaging and file-sharing service Keybase. The new end-to-end encrypted meeting mode will be available to all paid accounts, Zoom said.Zoom end-to-end encryption

“Logged-in users will generate public cryptographic identities that are stored in a repository on Zoom’s network and can be used to establish trust relationships between meeting attendees. An ephemeral per-meeting symmetric key will be generated by the meeting host. This key will be distributed between clients, enveloped with the asymmetric keypairs and rotated when there are significant changes to the list of attendees. The cryptographic secrets will be under the control of the host, and the host’s client software will decide what devices are allowed to receive meeting keys, and thereby join the meeting,” the company explained when it announced the acquisition of Keybase.

Zoom announced this week that a detailed draft of its cryptographic design for end-to-end encryption will be made public on Friday. The draft will not include any code, but the company hopes to get some feedback before the feature is developed.

“We will be hosting discussions with cryptographic experts, customers, advocacy groups, and others to solicit feedback to evaluate for the final design,” Zoom said on Wednesday.

Zoom is also working on revamping its bug bounty program with the help of Luta Security. In the meantime, researchers can report vulnerabilities on zoom.us/security or by sending an email to security(at)zoom.us.

The company also plans on conducting a comprehensive security review and it has hired former Facebook CSO Alex Stamos to help it implement better security controls and practices. It has also created a CISO Council that will advise Zoom CEO Eric Yuan on security.

Advertisement. Scroll to continue reading.

Related: Trojanized Zoom Apps Target Remote Workers

Related: Zoom Agrees to Step Up Security After New York Probe

Related: Zoom Credentials Database Available on Dark Web

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

CISO Conversations

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.

CISO Strategy

Security professionals understand the need for resilience in their company’s security posture, but often fail to build their own psychological resilience to stress.