Security and Privacy Implications of Zoom
They’re additionally mendacity concerning the kind of encryption. On 4/3, Citizen Lab reported
Zoom documentation claims that the app makes use of “AES-256” encryption for conferences the place potential. Nonetheless, we discover that in every Zoom assembly, a single AES-128 key’s utilized in ECB mode by all individuals to encrypt and decrypt audio and video. The use of ECB mode will not be really helpful as a result of patterns current within the plaintext are preserved throughout encryption.
The AES-128 keys, which we verified are enough to decrypt Zoom packets intercepted in Web site visitors, look like generated by Zoom servers, and in some instances, are delivered to individuals in a Zoom assembly by servers in China, even when all assembly individuals, and the Zoom subscriber’s firm, are outdoors of China.