End-to-End Encryption: How Your Messages Stay Private

Why End-to-End Encryption Matters

Imagine sending a postcard through the mail. Anyone who handles it - the postal worker, the mail carrier, even your nosy neighbor - can read it. That's how most online communication works without E2E encryption.

Now imagine putting that postcard in a locked box that only you and the recipient have keys to. That's E2E encryption. Even if someone intercepts the box, they can't open it.

The Coffee Shop Analogy

Let's understand E2E with a story. Alice wants to send Bob a secret recipe while they're in a crowded coffee shop.

Without Encryption (HTTP)

Alice shouts the recipe across the room. Everyone hears it. That's the internet without encryption.

With Basic Encryption (HTTPS)

Alice whispers to the waiter, who then whispers to Bob. The other customers can't hear, but the waiter knows the recipe. That's HTTPS - secure from others, but the server (waiter) knows everything.

With End-to-End Encryption

Alice and Bob invent a secret language only they understand. Alice shouts in this language. Everyone hears gibberish, including the waiter. Only Bob understands. That's E2E encryption.

Encryption Basics for Humans

Before diving into code, let's understand three fundamental concepts:

1. Symmetric Encryption (Shared Secret)

Like a padlock where both people have identical keys. Fast but requires sharing the key securely first.

// Symmetric encryption example (simplified)
class SymmetricEncryption {
    constructor(secretKey) {
        this.key = secretKey; // Same key for encrypt and decrypt
    }
    
    encrypt(message) {
        // In reality, this uses AES-256 or similar
        return scramble(message, this.key);
    }
    
    decrypt(encrypted) {
        // Use the same key to unscramble
        return unscramble(encrypted, this.key);
    }
}

// Both Alice and Bob need the same key
const sharedKey = "our-secret-key-123";
const aliceCrypto = new SymmetricEncryption(sharedKey);
const bobCrypto = new SymmetricEncryption(sharedKey);

// Alice encrypts
const encrypted = aliceCrypto.encrypt("Hello Bob!");

// Bob decrypts with same key
const message = bobCrypto.decrypt(encrypted);
console.log(message); // "Hello Bob!"

2. Asymmetric Encryption (Public/Private Keys)

Like a mailbox: anyone can drop mail in (public key), but only the owner can open it (private key).

// Asymmetric encryption example (simplified)
class AsymmetricEncryption {
    constructor() {
        // Generate a key pair
        this.privateKey = generatePrivateKey();
        this.publicKey = derivePublicKey(this.privateKey);
    }
    
    // Anyone can encrypt with public key
    encryptForRecipient(message, recipientPublicKey) {
        return encryptWithPublicKey(message, recipientPublicKey);
    }
    
    // Only owner can decrypt with private key
    decryptWithMyKey(encrypted) {
        return decryptWithPrivateKey(encrypted, this.privateKey);
    }
}

// Bob generates his keys
const bob = new AsymmetricEncryption();

// Bob shares his public key openly
console.log("Bob's public key:", bob.publicKey);

// Alice uses Bob's public key to encrypt
const alice = new AsymmetricEncryption();
const secretMessage = alice.encryptForRecipient(
    "Secret message for Bob",
    bob.publicKey
);

// Only Bob can decrypt with his private key
const decrypted = bob.decryptWithMyKey(secretMessage);
console.log(decrypted); // "Secret message for Bob"

// Even Alice can't decrypt what she encrypted!
// alice.decryptWithMyKey(secretMessage); // ❌ Fails

3. Hashing (One-Way Function)

Like a fingerprint: unique for each message, but you can't recreate the person from the fingerprint.

// Hashing example
function hash(message) {
    // Real implementation uses SHA-256 or similar
    // This creates a unique "fingerprint" of the message
    return crypto.createHash('sha256')
        .update(message)
        .digest('hex');
}

const message1 = "Hello World";
const message2 = "Hello World!"; // Just added !

console.log(hash(message1)); 
// "a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b5..."

console.log(hash(message2)); 
// "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284..." 
// Completely different!

// You can't reverse it
// unhash("a591a6d40bf4...") // ❌ Impossible!

The Key Exchange Problem

The biggest challenge in encryption: how do Alice and Bob agree on a secret key when Eve is listening to everything they say?

Diffie-Hellman: The Paint Mixing Analogy

Imagine Alice and Bob want to create the same secret color, but they can only exchange paint in public:

1. They agree on a public color (yellow) - everyone knows this
2. Alice picks a secret color (red) - only she knows
3. Bob picks a secret color (blue) - only he knows
4. Alice mixes yellow + red = orange, sends orange to Bob
5. Bob mixes yellow + blue = green, sends green to Alice
6. Alice mixes green + red = brown
7. Bob mixes orange + blue = brown
8. Both have brown! Eve saw yellow, orange, and green but can't make brown

// Diffie-Hellman Key Exchange (simplified)
class DiffieHellman {
    constructor() {
        // These would be large prime numbers in reality
        this.prime = 23;
        this.generator = 5;
    }
    
    generatePrivateKey() {
        // Random number (in reality, cryptographically secure)
        return Math.floor(Math.random() * 10) + 1;
    }
    
    generatePublicKey(privateKey) {
        // Public key = generator^privateKey mod prime
        return Math.pow(this.generator, privateKey) % this.prime;
    }
    
    generateSharedSecret(theirPublicKey, myPrivateKey) {
        // Shared secret = theirPublicKey^myPrivateKey mod prime
        return Math.pow(theirPublicKey, myPrivateKey) % this.prime;
    }
}

// Alice and Bob each create DH instances
const aliceDH = new DiffieHellman();
const bobDH = new DiffieHellman();

// Each generates private key (never shared)
const alicePrivate = aliceDH.generatePrivateKey(); // e.g., 6
const bobPrivate = bobDH.generatePrivateKey();     // e.g., 9

// Each generates public key (shared openly)
const alicePublic = aliceDH.generatePublicKey(alicePrivate); // 8
const bobPublic = bobDH.generatePublicKey(bobPrivate);       // 11

// Exchange public keys (Eve can see these!)
console.log("Alice sends:", alicePublic);
console.log("Bob sends:", bobPublic);

// Each computes shared secret
const aliceSecret = aliceDH.generateSharedSecret(bobPublic, alicePrivate);
const bobSecret = bobDH.generateSharedSecret(alicePublic, bobPrivate);

console.log("Alice's secret:", aliceSecret); // 13
console.log("Bob's secret:", bobSecret);     // 13
// Same secret without ever exchanging it!

Building E2E Encryption Step by Step

Now let's build a real E2E encrypted messaging system. We'll use the Web Crypto API for actual cryptography.

Step 1: Generate Key Pairs

class E2EMessenger {
    constructor(username) {
        this.username = username;
        this.keyPair = null;
        this.contacts = new Map(); // Store other users' public keys
    }
    
    async initialize() {
        // Generate RSA key pair for this user
        this.keyPair = await crypto.subtle.generateKey(
            {
                name: "RSA-OAEP",
                modulusLength: 2048,
                publicExponent: new Uint8Array([1, 0, 1]),
                hash: "SHA-256",
            },
            true,  // extractable
            ["encrypt", "decrypt"]
        );
        
        console.log(`${this.username} initialized with key pair`);
        return this;
    }
    
    async exportPublicKey() {
        // Export public key for sharing
        const exported = await crypto.subtle.exportKey(
            "spki",
            this.keyPair.publicKey
        );
        return btoa(String.fromCharCode(...new Uint8Array(exported)));
    }
    
    async importPublicKey(publicKeyString, contactName) {
        // Import someone else's public key
        const binaryKey = Uint8Array.from(
            atob(publicKeyString),
            c => c.charCodeAt(0)
        );
        
        const publicKey = await crypto.subtle.importKey(
            "spki",
            binaryKey,
            {
                name: "RSA-OAEP",
                hash: "SHA-256"
            },
            true,
            ["encrypt"]
        );
        
        this.contacts.set(contactName, publicKey);
        console.log(`${this.username} added ${contactName}'s public key`);
    }
}

Step 2: Encrypt Messages

async encryptMessage(message, recipientName) {
    const recipientKey = this.contacts.get(recipientName);
    if (!recipientKey) {
        throw new Error(`No public key for ${recipientName}`);
    }
    
    // Convert message to bytes
    const encoder = new TextEncoder();
    const messageBytes = encoder.encode(message);
    
    // Generate AES key for this message (hybrid encryption)
    const aesKey = await crypto.subtle.generateKey(
        {
            name: "AES-GCM",
            length: 256
        },
        true,
        ["encrypt", "decrypt"]
    );
    
    // Encrypt message with AES (fast for large data)
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const encryptedMessage = await crypto.subtle.encrypt(
        {
            name: "AES-GCM",
            iv: iv
        },
        aesKey,
        messageBytes
    );
    
    // Encrypt AES key with recipient's RSA public key
    const exportedAesKey = await crypto.subtle.exportKey("raw", aesKey);
    const encryptedAesKey = await crypto.subtle.encrypt(
        {
            name: "RSA-OAEP"
        },
        recipientKey,
        exportedAesKey
    );
    
    // Package everything together
    return {
        encryptedKey: btoa(String.fromCharCode(...new Uint8Array(encryptedAesKey))),
        encryptedMessage: btoa(String.fromCharCode(...new Uint8Array(encryptedMessage))),
        iv: btoa(String.fromCharCode(...iv)),
        sender: this.username,
        recipient: recipientName,
        timestamp: Date.now()
    };
}

Step 3: Decrypt Messages

async decryptMessage(encryptedData) {
    // Verify this message is for us
    if (encryptedData.recipient !== this.username) {
        throw new Error("Message not for this user");
    }
    
    // Decode from base64
    const encryptedKey = Uint8Array.from(
        atob(encryptedData.encryptedKey),
        c => c.charCodeAt(0)
    );
    const encryptedMessage = Uint8Array.from(
        atob(encryptedData.encryptedMessage),
        c => c.charCodeAt(0)
    );
    const iv = Uint8Array.from(
        atob(encryptedData.iv),
        c => c.charCodeAt(0)
    );
    
    // Decrypt AES key with our RSA private key
    const aesKeyBytes = await crypto.subtle.decrypt(
        {
            name: "RSA-OAEP"
        },
        this.keyPair.privateKey,
        encryptedKey
    );
    
    // Import AES key
    const aesKey = await crypto.subtle.importKey(
        "raw",
        aesKeyBytes,
        {
            name: "AES-GCM",
            length: 256
        },
        false,
        ["decrypt"]
    );
    
    // Decrypt message with AES key
    const decryptedBytes = await crypto.subtle.decrypt(
        {
            name: "AES-GCM",
            iv: iv
        },
        aesKey,
        encryptedMessage
    );
    
    // Convert bytes back to string
    const decoder = new TextDecoder();
    return {
        message: decoder.decode(decryptedBytes),
        sender: encryptedData.sender,
        timestamp: new Date(encryptedData.timestamp)
    };
}

Step 4: Complete Usage Example

// Complete E2E messaging example
async function demonstrateE2E() {
    // Alice and Bob create their messengers
    const alice = await new E2EMessenger("Alice").initialize();
    const bob = await new E2EMessenger("Bob").initialize();
    
    // Exchange public keys (through server or QR code)
    const alicePublicKey = await alice.exportPublicKey();
    const bobPublicKey = await bob.exportPublicKey();
    
    // Add each other as contacts
    await alice.importPublicKey(bobPublicKey, "Bob");
    await bob.importPublicKey(alicePublicKey, "Alice");
    
    // Alice sends encrypted message to Bob
    const secretMessage = "Meet me at the secret location at midnight 🕵️";
    const encrypted = await alice.encryptMessage(secretMessage, "Bob");
    
    console.log("Encrypted data:", encrypted);
    // This is what travels through the server
    // Server sees: {
    //   encryptedKey: "w7K9Fg2H8...",     // Gibberish
    //   encryptedMessage: "8hG5dK3...",  // Gibberish
    //   iv: "kL9mN2...",                 // Random
    //   sender: "Alice",                 // Metadata
    //   recipient: "Bob",                // Metadata
    //   timestamp: 1694592000000        // Metadata
    // }
    
    // Bob receives and decrypts
    const decrypted = await bob.decryptMessage(encrypted);
    console.log("Bob reads:", decrypted.message);
    // "Meet me at the secret location at midnight 🕵️"
    
    // Eve (the server) intercepts but can't read
    const eve = await new E2EMessenger("Eve").initialize();
    try {
        await eve.decryptMessage(encrypted);
    } catch (error) {
        console.log("Eve fails:", error.message);
        // "Message not for this user"
    }
    
    // Even if Eve changes recipient name
    encrypted.recipient = "Eve";
    try {
        await eve.decryptMessage(encrypted);
    } catch (error) {
        console.log("Eve still fails:", error.message);
        // "Cannot decrypt - no private key"
    }
}

demonstrateE2E();

How Signal Protocol Works

Signal Protocol (used by WhatsApp, Signal, and others) adds forward secrecy - even if your keys are stolen, past messages remain secure.

The Double Ratchet Algorithm

Imagine two gears (ratchets) that only turn forward:

1. Diffie-Hellman Ratchet: New key exchange for each message
2. Symmetric Key Ratchet: Derives new encryption keys from previous ones

// Simplified Signal Protocol implementation
class SignalProtocol {
    constructor(identity) {
        this.identity = identity;
        this.sessions = new Map();
    }
    
    async initializeSession(recipientIdentity) {
        // Generate ephemeral keys for this session
        const ephemeralKeyPair = await this.generateKeyPair();
        
        // Perform X3DH (Extended Triple Diffie-Hellman)
        const session = {
            rootKey: null,
            sendingChainKey: null,
            receivingChainKey: null,
            sendMessageNumber: 0,
            receiveMessageNumber: 0,
            previousSendingChainLength: 0
        };
        
        // Store session
        this.sessions.set(recipientIdentity, session);
        
        return session;
    }
    
    async ratchetSendingChain(session) {
        // Generate new ephemeral key pair
        const newKeyPair = await this.generateKeyPair();
        
        // Perform DH with recipient's public key
        const sharedSecret = await this.performDH(
            newKeyPair.privateKey,
            session.theirPublicKey
        );
        
        // KDF (Key Derivation Function) to get new root and chain keys
        const [newRootKey, newChainKey] = await this.kdf(
            session.rootKey,
            sharedSecret
        );
        
        session.rootKey = newRootKey;
        session.sendingChainKey = newChainKey;
        session.ourKeyPair = newKeyPair;
        
        return newKeyPair.publicKey;
    }
    
    async encryptWithRatchet(message, recipientIdentity) {
        const session = this.sessions.get(recipientIdentity);
        
        // Ratchet forward
        const newPublicKey = await this.ratchetSendingChain(session);
        
        // Derive message key from chain key
        const messageKey = await this.deriveMessageKey(
            session.sendingChainKey,
            session.sendMessageNumber
        );
        
        // Encrypt message
        const encrypted = await this.aesEncrypt(message, messageKey);
        
        // Update chain
        session.sendingChainKey = await this.advanceChainKey(
            session.sendingChainKey
        );
        session.sendMessageNumber++;
        
        return {
            ephemeralPublicKey: newPublicKey,
            messageNumber: session.sendMessageNumber - 1,
            ciphertext: encrypted
        };
    }
    
    // Key Derivation Function
    async kdf(rootKey, input) {
        const material = await crypto.subtle.importKey(
            "raw",
            input,
            { name: "HKDF" },
            false,
            ["deriveBits"]
        );
        
        const bits = await crypto.subtle.deriveBits(
            {
                name: "HKDF",
                hash: "SHA-256",
                salt: rootKey,
                info: new TextEncoder().encode("Signal_KDF")
            },
            material,
            512 // 64 bytes
        );
        
        // Split into two 32-byte keys
        const array = new Uint8Array(bits);
        return [
            array.slice(0, 32),  // New root key
            array.slice(32, 64)  // New chain key
        ];
    }
}

Real Application Implementation

Let's look at how a real financial app might implement E2E encryption for sensitive data:

// Real-world E2E implementation for financial app
interface EncryptedTransaction {
    id: string;
    encryptedData: string;
    encryptedKey: string;
    iv: string;
    signature: string;
    timestamp: number;
    recipientId: string;
}

class SecureFinancialMessaging {
    private keyManager: KeyManager;
    private crypto: CryptoService;
    
    constructor() {
        this.keyManager = new KeyManager();
        this.crypto = new CryptoService();
    }
    
    async sendTransaction(
        amount: number,
        recipientId: string,
        description: string
    ): Promise {
        // 1. Prepare sensitive data
        const transactionData = {
            amount,
            currency: 'USD',
            description,
            senderId: this.getCurrentUserId(),
            recipientId,
            timestamp: Date.now(),
            nonce: this.generateNonce()
        };
        
        // 2. Get recipient's public key
        const recipientKey = await this.keyManager.getPublicKey(recipientId);
        if (!recipientKey) {
            throw new Error('Recipient public key not found');
        }
        
        // 3. Generate ephemeral AES key for this transaction
        const aesKey = await this.crypto.generateAESKey();
        
        // 4. Encrypt transaction data with AES
        const { encrypted, iv } = await this.crypto.aesEncrypt(
            JSON.stringify(transactionData),
            aesKey
        );
        
        // 5. Encrypt AES key with recipient's public key
        const encryptedKey = await this.crypto.rsaEncrypt(
            aesKey,
            recipientKey
        );
        
        // 6. Sign the encrypted data for authenticity
        const signature = await this.signTransaction(encrypted);
        
        // 7. Create encrypted transaction object
        const encryptedTransaction: EncryptedTransaction = {
            id: this.generateTransactionId(),
            encryptedData: this.base64Encode(encrypted),
            encryptedKey: this.base64Encode(encryptedKey),
            iv: this.base64Encode(iv),
            signature: this.base64Encode(signature),
            timestamp: Date.now(),
            recipientId
        };
        
        // 8. Send through server (server can't read it!)
        await this.sendToServer(encryptedTransaction);
        
        // 9. Store in local encrypted database
        await this.storeLocally(encryptedTransaction);
        
        return encryptedTransaction;
    }
    
    async receiveTransaction(
        encrypted: EncryptedTransaction
    ): Promise {
        // 1. Verify we are the intended recipient
        if (encrypted.recipientId !== this.getCurrentUserId()) {
            throw new Error('Transaction not for this user');
        }
        
        // 2. Verify signature
        const senderKey = await this.keyManager.getPublicKey(
            encrypted.senderId
        );
        const isValid = await this.verifySignature(
            encrypted.encryptedData,
            encrypted.signature,
            senderKey
        );
        
        if (!isValid) {
            throw new Error('Invalid signature - possible tampering');
        }
        
        // 3. Decrypt AES key with our private key
        const aesKey = await this.crypto.rsaDecrypt(
            this.base64Decode(encrypted.encryptedKey),
            await this.keyManager.getPrivateKey()
        );
        
        // 4. Decrypt transaction data
        const decryptedData = await this.crypto.aesDecrypt(
            this.base64Decode(encrypted.encryptedData),
            aesKey,
            this.base64Decode(encrypted.iv)
        );
        
        // 5. Parse and validate transaction
        const transaction = JSON.parse(decryptedData);
        
        // 6. Verify nonce to prevent replay attacks
        if (await this.isNonceUsed(transaction.nonce)) {
            throw new Error('Replay attack detected');
        }
        await this.markNonceAsUsed(transaction.nonce);
        
        return transaction;
    }
    
    // Additional security: Perfect Forward Secrecy
    async establishSecureChannel(recipientId: string) {
        // Generate ephemeral keys for this session
        const ephemeralKeys = await this.crypto.generateEphemeralKeyPair();
        
        // Exchange ephemeral public keys
        const theirEphemeralKey = await this.exchangeEphemeralKeys(
            recipientId,
            ephemeralKeys.publicKey
        );
        
        // Derive shared secret using ECDH
        const sharedSecret = await this.crypto.deriveSharedSecret(
            ephemeralKeys.privateKey,
            theirEphemeralKey
        );
        
        // Delete ephemeral private key immediately
        await this.crypto.destroyKey(ephemeralKeys.privateKey);
        
        // Use shared secret for session encryption
        return this.createSecureSession(sharedSecret, recipientId);
    }
}

Key Management & Storage

Secure key storage is critical. Keys should never be stored in plain text.

class SecureKeyStorage {
    constructor() {
        this.storageKey = null;
    }
    
    async initialize(userPassword) {
        // Derive storage key from user password
        const salt = await this.getOrCreateSalt();
        this.storageKey = await this.deriveKeyFromPassword(
            userPassword,
            salt
        );
    }
    
    async deriveKeyFromPassword(password, salt) {
        // Use PBKDF2 to derive key from password
        const keyMaterial = await crypto.subtle.importKey(
            "raw",
            new TextEncoder().encode(password),
            { name: "PBKDF2" },
            false,
            ["deriveBits", "deriveKey"]
        );
        
        return crypto.subtle.deriveKey(
            {
                name: "PBKDF2",
                salt: salt,
                iterations: 100000, // High iteration count
                hash: "SHA-256"
            },
            keyMaterial,
            { name: "AES-GCM", length: 256 },
            false,
            ["encrypt", "decrypt"]
        );
    }
    
    async storePrivateKey(privateKey, keyId) {
        // Export private key
        const exported = await crypto.subtle.exportKey(
            "pkcs8",
            privateKey
        );
        
        // Encrypt with storage key
        const iv = crypto.getRandomValues(new Uint8Array(12));
        const encrypted = await crypto.subtle.encrypt(
            { name: "AES-GCM", iv: iv },
            this.storageKey,
            exported
        );
        
        // Store encrypted in IndexedDB/SecureStorage
        await this.secureStore.set(keyId, {
            encrypted: encrypted,
            iv: iv,
            version: 1,
            algorithm: "RSA-OAEP"
        });
    }
    
    async retrievePrivateKey(keyId) {
        // Get from secure storage
        const stored = await this.secureStore.get(keyId);
        
        // Decrypt with storage key
        const decrypted = await crypto.subtle.decrypt(
            { name: "AES-GCM", iv: stored.iv },
            this.storageKey,
            stored.encrypted
        );
        
        // Import as CryptoKey
        return crypto.subtle.importKey(
            "pkcs8",
            decrypted,
            {
                name: stored.algorithm,
                hash: "SHA-256"
            },
            false,
            ["decrypt"]
        );
    }
    
    // Secure deletion
    async deleteKey(keyId) {
        // Overwrite with random data before deletion
        const randomData = crypto.getRandomValues(new Uint8Array(2048));
        await this.secureStore.set(keyId, randomData);
        await this.secureStore.delete(keyId);
    }
}

Identity Verification

How do you know you're really talking to who you think you are? That's the identity verification problem.

QR Code Verification

class IdentityVerification {
    async generateVerificationCode(myKey, theirKey) {
        // Combine both public keys
        const combined = await this.combineKeys(myKey, theirKey);
        
        // Hash to create fingerprint
        const hash = await crypto.subtle.digest("SHA-256", combined);
        
        // Convert to readable format
        const numbers = Array.from(new Uint8Array(hash))
            .map(byte => byte.toString().padStart(3, '0'))
            .join(' ');
        
        // Group into blocks for readability
        // "123 456 789 012 345 678 901 234"
        return numbers.match(/.{1,12}/g).join(' ');
    }
    
    async generateQRCode(verificationCode) {
        // Generate QR code containing verification code
        return QRCode.toDataURL(verificationCode, {
            errorCorrectionLevel: 'H',
            margin: 2,
            width: 256
        });
    }
    
    async verifyInPerson(myCode, theirCode) {
        // Compare codes shown on both devices
        return myCode === theirCode;
    }
}

Group Chat Encryption

Group chats are more complex - you need to encrypt for multiple recipients efficiently.

class GroupE2EChat {
    constructor(groupId) {
        this.groupId = groupId;
        this.members = new Map();
        this.groupKey = null;
    }
    
    async createGroup(memberIds) {
        // Generate group symmetric key
        this.groupKey = await crypto.subtle.generateKey(
            { name: "AES-GCM", length: 256 },
            true,
            ["encrypt", "decrypt"]
        );
        
        // Encrypt group key for each member
        const encryptedKeys = new Map();
        
        for (const memberId of memberIds) {
            const memberPublicKey = await this.getMemberPublicKey(memberId);
            const encryptedGroupKey = await this.encryptGroupKeyForMember(
                this.groupKey,
                memberPublicKey
            );
            encryptedKeys.set(memberId, encryptedGroupKey);
        }
        
        // Distribute encrypted keys
        await this.distributeGroupKeys(encryptedKeys);
    }
    
    async sendGroupMessage(message) {
        // Encrypt with group key (once for all members!)
        const iv = crypto.getRandomValues(new Uint8Array(12));
        const encrypted = await crypto.subtle.encrypt(
            { name: "AES-GCM", iv: iv },
            this.groupKey,
            new TextEncoder().encode(message)
        );
        
        return {
            groupId: this.groupId,
            encrypted: this.base64Encode(encrypted),
            iv: this.base64Encode(iv),
            senderId: this.myId,
            timestamp: Date.now()
        };
    }
    
    async addMember(newMemberId) {
        // Re-key the group for forward secrecy
        const newGroupKey = await crypto.subtle.generateKey(
            { name: "AES-GCM", length: 256 },
            true,
            ["encrypt", "decrypt"]
        );
        
        // Distribute new key to all members including new one
        await this.rekeyGroup(newGroupKey, [...this.members.keys(), newMemberId]);
        
        this.groupKey = newGroupKey;
    }
    
    async removeMember(memberId) {
        // Must re-key so removed member can't read new messages
        const remainingMembers = [...this.members.keys()]
            .filter(id => id !== memberId);
        
        const newGroupKey = await crypto.subtle.generateKey(
            { name: "AES-GCM", length: 256 },
            true,
            ["encrypt", "decrypt"]
        );
        
        await this.rekeyGroup(newGroupKey, remainingMembers);
        this.groupKey = newGroupKey;
        this.members.delete(memberId);
    }
}

Common Implementation Mistakes

// ❌ WRONG: Common mistakes
class BadEncryption {
    constructor() {
        // ❌ Hardcoded key
        this.key = "my-secret-key-123";
        
        // ❌ Reused IV
        this.iv = new Uint8Array([1,2,3,4,5,6,7,8,9,10,11,12]);
    }
    
    encrypt(message) {
        // ❌ Weak encryption (XOR)
        return message.split('').map((char, i) => 
            char.charCodeAt(0) ^ this.key.charCodeAt(i % this.key.length)
        ).join('');
    }
    
    generateKey() {
        // ❌ Weak random (Math.random)
        return Math.random().toString(36).substring(7);
    }
    
    storeKey(key) {
        // ❌ Plain text storage
        localStorage.setItem('encryptionKey', key);
    }
}

// ✅ CORRECT: Secure implementation
class GoodEncryption {
    async generateKey() {
        // ✅ Cryptographically secure key generation
        return crypto.subtle.generateKey(
            { name: "AES-GCM", length: 256 },
            true,
            ["encrypt", "decrypt"]
        );
    }
    
    async encrypt(message, key) {
        // ✅ Fresh random IV for each encryption
        const iv = crypto.getRandomValues(new Uint8Array(12));
        
        // ✅ Strong authenticated encryption (AES-GCM)
        const encrypted = await crypto.subtle.encrypt(
            { name: "AES-GCM", iv: iv },
            key,
            new TextEncoder().encode(message)
        );
        
        return { encrypted, iv };
    }
    
    async storeKey(key, password) {
        // ✅ Encrypted storage with key derivation
        const salt = crypto.getRandomValues(new Uint8Array(16));
        const derivedKey = await this.deriveKeyFromPassword(password, salt);
        const encryptedKey = await this.encryptKey(key, derivedKey);
        
        // Store encrypted
        await secureStorage.set('encryptedKey', encryptedKey);
        await secureStorage.set('salt', salt);
    }
}

Security Considerations

1. Metadata Leakage

E2E encryption protects message content, but not metadata (who talks to whom, when, how often).

// Metadata minimization strategies
class MetadataProtection {
    // Pad messages to hide length
    padMessage(message, blockSize = 1024) {
        const messageBytes = new TextEncoder().encode(message);
        const paddingLength = blockSize - (messageBytes.length % blockSize);
        const padding = new Uint8Array(paddingLength);
        crypto.getRandomValues(padding);
        
        return {
            message: messageBytes,
            padding: padding,
            originalLength: messageBytes.length
        };
    }
    
    // Add decoy traffic
    async sendDecoyMessage() {
        const decoySize = 100 + Math.floor(Math.random() * 900);
        const decoyData = crypto.getRandomValues(new Uint8Array(decoySize));
        
        await this.send({
            type: 'decoy',
            data: decoyData,
            timestamp: Date.now() + Math.random() * 1000 // Random delay
        });
    }
    
    // Batch and delay messages
    async batchSend(messages) {
        // Shuffle to hide order
        const shuffled = this.shuffle(messages);
        
        // Add random delays
        for (const message of shuffled) {
            await this.delay(Math.random() * 5000);
            await this.send(message);
        }
    }
}

2. Key Compromise Recovery

// Implement key rotation and revocation
class KeyRotation {
    async rotateKeys() {
        // Generate new key pair
        const newKeyPair = await this.generateKeyPair();
        
        // Sign new key with old key for continuity
        const signature = await this.signWithOldKey(newKeyPair.publicKey);
        
        // Notify all contacts
        await this.broadcastKeyUpdate({
            oldKeyId: this.currentKeyId,
            newPublicKey: newKeyPair.publicKey,
            signature: signature,
            timestamp: Date.now()
        });
        
        // Archive old key (don't delete immediately)
        await this.archiveKey(this.currentKeyPair);
        
        // Start using new key
        this.currentKeyPair = newKeyPair;
        this.currentKeyId = await this.generateKeyId(newKeyPair.publicKey);
    }
    
    async emergencyKeyRevocation() {
        // Immediate key destruction
        await this.destroyKey(this.currentKeyPair.privateKey);
        
        // Generate new keys
        await this.rotateKeys();
        
        // Send emergency revocation notice
        await this.broadcastEmergencyRevocation({
            revokedKeyId: this.currentKeyId,
            reason: 'compromise_suspected',
            timestamp: Date.now()
        });
    }
}

3. Side-Channel Attacks

// Constant-time operations to prevent timing attacks
class ConstantTimeOps {
    // Constant-time comparison
    constantTimeCompare(a, b) {
        if (a.length !== b.length) {
            return false;
        }
        
        let result = 0;
        for (let i = 0; i < a.length; i++) {
            result |= a[i] ^ b[i];
        }
        
        return result === 0;
    }
    
    // Blind operations to prevent power analysis
    async blindedDecryption(ciphertext, privateKey) {
        // Add random blinding factor
        const blindingFactor = crypto.getRandomValues(new Uint8Array(32));
        
        // Decrypt with blinding
        const blinded = await this.applyBlinding(ciphertext, blindingFactor);
        const decrypted = await this.decrypt(blinded, privateKey);
        const unblinded = await this.removeBlinding(decrypted, blindingFactor);
        
        // Clear blinding factor from memory
        blindingFactor.fill(0);
        
        return unblinded;
    }
}

Testing E2E Encryption

// Comprehensive E2E encryption tests
describe('E2E Encryption Tests', () => {
    let alice, bob, eve;
    
    beforeEach(async () => {
        alice = await new E2EMessenger('Alice').initialize();
        bob = await new E2EMessenger('Bob').initialize();
        eve = await new E2EMessenger('Eve').initialize();
    });
    
    test('Basic encryption and decryption', async () => {
        // Exchange keys
        await alice.addContact('Bob', await bob.exportPublicKey());
        await bob.addContact('Alice', await alice.exportPublicKey());
        
        // Send message
        const message = 'Secret message';
        const encrypted = await alice.encryptMessage(message, 'Bob');
        const decrypted = await bob.decryptMessage(encrypted);
        
        expect(decrypted.message).toBe(message);
        expect(decrypted.sender).toBe('Alice');
    });
    
    test('Cannot decrypt without private key', async () => {
        await alice.addContact('Bob', await bob.exportPublicKey());
        
        const encrypted = await alice.encryptMessage('Secret', 'Bob');
        
        // Eve intercepts but cannot decrypt
        await expect(eve.decryptMessage(encrypted))
            .rejects.toThrow('Message not for this user');
    });
    
    test('Detects message tampering', async () => {
        await alice.addContact('Bob', await bob.exportPublicKey());
        await bob.addContact('Alice', await alice.exportPublicKey());
        
        const encrypted = await alice.encryptMessage('Original', 'Bob');
        
        // Tamper with encrypted message
        encrypted.encryptedMessage = tamperWith(encrypted.encryptedMessage);
        
        await expect(bob.decryptMessage(encrypted))
            .rejects.toThrow('Decryption failed - data corrupted');
    });
    
    test('Forward secrecy after key rotation', async () => {
        // Initial setup
        await alice.addContact('Bob', await bob.exportPublicKey());
        await bob.addContact('Alice', await alice.exportPublicKey());
        
        // Send message with first key
        const message1 = await alice.encryptMessage('Message 1', 'Bob');
        
        // Rotate keys
        await alice.rotateKeys();
        await bob.rotateKeys();
        
        // Exchange new keys
        await alice.updateContact('Bob', await bob.exportPublicKey());
        await bob.updateContact('Alice', await alice.exportPublicKey());
        
        // Send message with new key
        const message2 = await alice.encryptMessage('Message 2', 'Bob');
        
        // Compromise current keys
        const compromisedAlice = alice.exportPrivateKey();
        const compromisedBob = bob.exportPrivateKey();
        
        // Eve gets compromised keys
        eve.importCompromisedKey(compromisedAlice);
        eve.importCompromisedKey(compromisedBob);
        
        // Eve can decrypt message2 but not message1
        expect(await eve.tryDecrypt(message2)).toBe('Message 2');
        expect(await eve.tryDecrypt(message1)).toBe(null);
    });
    
    test('Performance: Encrypts 1000 messages in < 1 second', async () => {
        await alice.addContact('Bob', await bob.exportPublicKey());
        
        const start = Date.now();
        
        for (let i = 0; i < 1000; i++) {
            await alice.encryptMessage(`Message ${i}`, 'Bob');
        }
        
        const duration = Date.now() - start;
        expect(duration).toBeLessThan(1000);
    });
});

Performance Impact

Conclusion

End-to-end encryption is complex but essential for privacy. The key principles:

• Only endpoints can decrypt: Not even the server can read messages
• Use established protocols: Don't roll your own crypto
• Forward secrecy matters: Past messages should stay secure
• Verify identities: Encryption without authentication is useless
• Test thoroughly: Security bugs are catastrophic

Remember: E2E encryption is a tool, not a silver bullet. It protects message content but not metadata. It ensures privacy but not anonymity. Use it wisely, implement it correctly, and always keep learning about security.