Encrypted Messaging Platform 'Threema' Rolls Out New Communication Protocol 'Ibex'
No one other than the intended recipient can read transmitted messages, not even Threema as the service operator. It’s not required to provide any personal data whatsoever: If so desired, Threema can be used completely anonymously, i.e., without disclosing one’s phone number or email address.
- Just in time for the upcoming tenth anniversary, Threema introduces “Ibex,” a new cryptographic communication protocol that further solidifies Threema’s time-tested security and future-proofs the overall system. On top of that, the overhauled protocol suite receives additional key components that lay the groundwork for forthcoming feature.
- In addition to the new Ibex protocol, which introduces Perfect Forward Secrecy to the end-to-end layer, the extended protocol suite also includes specifications for end-to-end encrypted group calls and a protocol for the upcoming multi-device functionality.
- On the transport layer, Threema has always supported Perfect Forward Secrecy (PFS). And just as is the case with group calls (see above), PFS has always been enforced on the end-to-end layer in one-to-one calls. The new Ibex protocol now also supports the exchange of ephemeral keys for chat messages on the end-to-end layer (using ECDH).
- For each message, a new key is used from which it’s not possible to derive previous keys (thanks to KDF ratcheting). This is to say that even if the Threema server were compromised and an attacker could store end-to-end encrypted messages, it would still not be possible for them to decrypt any past message even if they somehow gained access to the current key of a user.
- With regard to a compromised server, the cryptographic properties of PFS also guarantee that an attacker (who is unable read messages in any case due to end-to-end encryption) cannot send messages to the recipient more than once, omit individual messages, or reorder messages without it being noticed.
