0

Our team has developed a Hybrid app which is based on IndexedDB to support cross platforms. This app now has a chat feature and we want to store chats for offline readability. But as a rule of thumb, we can store Meta data of chats in plain text but not the actual chat message text contents. So, we decided to encrypt them.

Problem: Now the problem comes when user wants to search for a message which contains any specific word, it can be any language or text.

We tried to research what Whatsapp implement for this functionality and came across multiple articles like https://www.group-ib.com/blog/whatsapp-forensic-artifacts/ and few others but it shows for native apps, sqlite databases (msgstore.db, wa.db etc) in root folder are not encrypted not even a single field. While there are some databases which are encrypted like msgstore.db.cryptxx but they are mostly backups.

Questions

  1. Should we assume that Whatsapp only encrypts messages while sending and receiving not storing?

  2. Does whatsapp store messages in plain text in IndexedDB for web? We couldn't find any except meta data.

  3. If Whatsapp encrypts every message whether sqlite or IndexedDB for web, then how does it perform searching for messages?

  4. What options do we have? How should we store messages in IndexedDB which can be encrypted and yet searchable?

There is a question related to this but neither it has the proper answer nor it is asked about IndexedDB which can be easily viewed by end users.

Improve this question

1 Answer 1

Reset to default
1

Most apps would only encrypt the data at rest when it is in a file, or when it is in transit over a network. To work with data in memory (as with a search) the data must be decrypted first. With databases, this is generally done using some sort of "transparent data encryption" feature, allowing the database SQL engine to see decrypted data as it is read from disk. Data is only decrypted in memory, while in use. If it is transmitted or written back to disk, it is transparently re-encrypted by the network driver or database, independent of the application.

If your encryption is being handled by your app and not the database, then the app would need to read all of the relevant encrypted data back into memory and decrypt it internally before executing the search within the app: the SQL engine of the database would thus be useless for searches because the database would never see the decrypted data.

Improve this answer
1
  • That makes a lot of sense. Actually, I didn't know about TDE with SQLite and even knew very little about SQLite itself. And IndexedDB does not support TDE. I think I need to run benchmarks on Encryption/Decryption while read/write data to IndexedDB.
    – Abdul Jabbar
    Commented Mar 28 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.