Follow Us:
Wednesday, May 12, 2021

Whatsapp is not breaking Indian laws with 256-bit encryption, for now

India does not have any regulation in place for OTT messaging apps like Whatsapp or Facebook Messenger and certainly nothing on the encryption they can use.

Written by Nandagopal Rajan |
Updated: April 12, 2016 9:00:27 am
WhatsApp encryption, WhatsApp end-to-end encryption, WhatsApp end-to-end encryption feature, WhatsApp, WhatsApp feature, WhatsApp 256-bit encryption, technology, technology news WhatsApp now has end-to-end encryption, and using 256-bit encryption but that does not make the app illegal in India.

Ever since Whatsapp announced end-to-end encryption there has been a flurry of reports on how the world’s most popular messenger service might have made itself illegal in India by switching on 256-bit encryption.

But that is not really right. India does not have any regulation in place for OTT messaging apps like Whatsapp or Facebook Messenger and certainly nothing that stipulates what type of encryption they can use.

“In my view, under the existing regulatory framework, 256 bit encryption is certainly not prohibited. When it comes to the telecommunications space, the framework gets a little more complex with differing requirements (like restriction on bulk encryption and cap of key lengths at 40bits) being applicable to holders of different licenses or authorisations. However, in any case, these obligations currently only apply to license holders themselves (such as ISPs and TSPs) and not to internet, (i.e., over the top (OTT)) applications like WhatsApp,” explains Tarun Krishnakumar, a Delhi-based lawyer specialising in technology.

Also read: Whatsapp: Encryption has never been available to so many people before

The government’s draft policy on encryption placed was expected to place restrictions on what key sizes OTT players could use, but that draft has since been scrapped and is being reworked.

There is also the issue that the 40-bit key length, which ISPs and TSPs have to stick to, is pretty low by all standards these days. The US National Institute of Standards and Technology (NIST) no longer allows anything lower that 80-bit, that too only with three-key Triple DES (Data Encryption Standard), which is anyway being phased out in favour of advanced encryption standards like AES 128, AES 192, AES 256. Whatsapp uses AES 256, which is the strongest of the lot.

So, till the government stipulates what keys OTT messengers or other Internet players need to stick to, there is nothing wrong with Whatsapp’s 256-bit encryption.

Must read: WhatsApp end-to-end encryption: Here is how it works

📣 The Indian Express is now on Telegram. Click here to join our channel (@indianexpress) and stay updated with the latest headlines

For all the latest Technology News, download Indian Express App.

  • The Indian Express website has been rated GREEN for its credibility and trustworthiness by Newsguard, a global service that rates news sources for their journalistic standards.