  WhatsApp messenger is arguably the most popular mobile app available on all
smart-phones. Over one billion people worldwide for free messaging, calling,
and media sharing use it. In April 2016, WhatsApp switched to a default
end-to-end encrypted service. This means that all messages (SMS), phone calls,
videos, audios, and any other form of information exchanged cannot be read by
any unauthorized entity since WhatsApp. In this paper we analyze the WhatsApp
messaging platform and critique its security architecture along with a focus on
its privacy preservation mechanisms. We report that the Signal Protocol, which
forms the basis of WhatsApp end-to-end encryption, does offer protection
against forward secrecy, and MITM to a large extent. Finally, we argue that
simply encrypting the end-to-end channel cannot preserve privacy. The metadata
can reveal just enough information to show connections between people, their
patterns, and personal information. This paper elaborates on the security
architecture of WhatsApp and performs an analysis on the various protocols
used. This enlightens us on the status quo of the app security and what further
measures can be used to fill existing gaps without compromising the usability.
We start by describing the following (i) important concepts that need to be
understood to properly understand security, (ii) the security architecture,
(iii) security evaluation, (iv) followed by a summary of our work. Some of the
important concepts that we cover in this paper before evaluating the
architecture are - end-to-end encryption (E2EE), signal protocol, and
curve25519. The description of the security architecture covers key management,
end-to-end encryption in WhatsApp, Authentication Mechanism, Message Exchange,
and finally the security evaluation. We then cover importance of metadata and
role it plays in conserving privacy with respect to whatsapp.
