Cryptology ePrint Archive: Report 2021/486

Security Analysis of End-to-End Encryption for Zoom Meetings

Takanori Isobe and Ryoma Ito

Abstract: In the wake of the global COVID-19 pandemic, video conference systems have become essential for not only business purposes, but also private, academic, and educational uses. Among the various systems, Zoom is the most widely deployed video conference system. In October 2020, Zoom Video Communications rolled out their end-to-end encryption (E2EE) to protect conversations in a meeting from even insiders, namely, the service provider Zoom. In this study, we conduct thorough security evaluations of the E2EE of Zoom (version 2.3.1) by analyzing their cryptographic protocols. We discover several attacks more powerful than those expected by Zoom according to their whitepaper. Specifically, if insiders collude with meeting participants, they can impersonate any Zoom user in target meetings, whereas Zoom indicates that they can impersonate only the current meeting participants. Besides, even without relying on malicious participants, insiders can impersonate any Zoom user in target meetings though they cannot decrypt meeting streams. In addition, we demonstrate several impersonation attacks by meeting participants or insiders colluding with meeting participants. Although these attacks may be beyond the scope of the security claims made by Zoom or may be already mentioned in the whitepaper, we reveal the details of the attack procedures and their feasibility in the real-world setting and propose effective countermeasures in this paper. Our findings are not an immediate threat to the E2EE of Zoom; however, we believe that these security evaluations are of value for deeply understanding the security of E2EE of Zoom.

Category / Keywords: cryptographic protocols / Zoom, End-to-End Encryption, Impersonation attacks

Original Publication (in the same form): IEEE Access
DOI:
10.1109/ACCESS.2021.3091722

Date: received 15 Apr 2021, last revised 21 Jun 2021

Contact author: takanori isobe at ai u-hyogo ac jp, itorym at nict go jp

Available format(s): PDF | BibTeX Citation

Version: 20210621:112715 (All versions of this report)

Short URL: ia.cr/2021/486


[ Cryptology ePrint archive ]