Listen to this story below:
When you send an online message, who can see it? Who is responsible for keeping those messages safe? What happens next?
An example of an abusive text conversation. (illustration by Corina Prassos)
While it’s a quick process that many of us take for granted, UNC-Chapel Hill computer scientist Saba Eskandarian is dedicated to deciphering the problems that come along with online messaging. He studies secure communication systems and applies his knowledge of cryptography — the technique of protecting information by shrouding it in codes — in new ways.
Messaging applications that provide strong privacy regulations can have the unintended side effect of making it harder for users to report abuse. When the platform cannot see the contents of users’ messages or does not know who’s talking to who, it can never know if a report of abusive content is real or not.
“It’s like when you write someone a letter to the post office,” he says. “The post person can see that there’s a letter going out, but they can’t see what’s inside the letter. My research focuses on what’s on the outside of the envelope.”
Unveiling ancient secrets
The word cryptography comes from the Greek words kryptos and graphien, roughly translating to “hidden writing.” The first evidence of cryptography being used in some form was inscriptions in Egyptian tombs thousands of years ago, as early as 1900 BC.
Over time, ancient civilizations developed different ciphers to encrypt or decrypt messages, ranging from purposefully scrambling letters to enciphering messages within recipes for ceramic glazes.
Up until the 1970s, cryptography’s main use was deciphering the contents of an opponent’s messages during wartime, playing a major part in the Allies’ success in World War II.
In 1975, IBM developed the first cryptosystem certified by the National Institute for Standards and Technology due to customer demand for encryption. This laid the foundation for the systems and standards used today, with cybersecurity and cryptography going hand in hand for the first time.
But if an attacker compromises a cryptography system, they can decipher every message ever encrypted by that system.
As these attacks become more prevalent and frequent in the modern age of online messaging, the locks on these systems are getting tighter. But much like today’s technology, cryptographic applications must be updated and ever-changing, much like Eskandarian’s work.
“It’s a field where there’s pressing, real-world problems and fascinating mathematical problems,” he says. “They’re close enough to each other that the same person can work on both. That’s a rare thing.”
Decrypting digital differences
There are two types of major private messaging platforms: end-to-end encrypted and metadata-hiding.
When messages are end-to-end encrypted, the moderator longer see the message contents. When a user wants to report a message for any reason, they must prove to the moderator that the abusive content corresponds with the identity of the sender.
The metadata-hiding setting poses an even greater challenge, as the moderator sees neither message contents nor the identities of message senders.
A fairly new cryptographic tool designed for content moderation in online end-to-end messaging systems is called message franking. First introduced by Facebook and used in both WhatsApp and Messenger Secret Conversations, it allows the receiver of a malicious message to report it to the moderator.
When a message is sent in an end-to-end encrypted platform, such as Facebook Messenger, an algorithm called the Hash-Based Message Authentication Code (HMAC) creates a binding tag for it. This identifier is specific, sent to the recipient along with the message — like a postmark on an envelope — and is readable by Facebook if abuse is reported.
“If a user shows this tag to Facebook, Facebook can verify that it’s authentic, but if somebody else sees the tag, they cannot verify that it came from Facebook,” Eskandarian shares. “This is helpful because it means that the platform itself can verify messages for moderation purposes, but users can’t just send messages to the government or the press to harm each other.”
Currently, there are no effective techniques for doing this on metadata-hiding platforms — many of which are still prototypes but will hit the market soon.
Enter Eskandarian, who’s implementing new cryptographic approaches to design private messaging applications that allow users to report abusive content to the platform without compromising the privacy of other messages or conversations.
He and his research team propose a shared franking technique, which would let the moderator authenticate messages sent through a metadata-hiding platform and tie them to their senders, despite only seeing content relevant to the report. This new application drastically decreases the time needed to decrypt and verify these messages.
Eskandarian believes a successful shared franking scheme needs four security properties: confidentiality, accountability, unforgeability, and deniability. It should safeguard the identity of the sender and the message contents, make each message reportable, protect users from being framed for messages they didn’t send, and ensure the moderator is the sole verifier for reported messages.
Safeguarding the future
A key part of Eskandarian’s research is educating the next generation on the importance and realities of online safety.
With the development of new online platforms comes many opportunities, but also challenges that have never been faced before. Individuals are interacting with these platforms at younger and younger ages, which makes Eskandarian’s research and teaching that much more important.
At Carolina, Eskandarian teaches courses in cryptography and privacy-enhancing technologies. For high school students, he’s given several presentations on cryptography and is working with the Virginia Science Olympiad to develop a cybersecurity trial event.
One tool he uses to explain his research to young students is a cipher wheel. As they turn each piece, secret messages can be scrambled and unscrambled, providing a visual, hands-on demonstration of how messages are encrypted.
“Understanding why something is useful or important is one of the biggest ways to motivate someone to study that thing,” he says. “I think, at least I hope, that if I work on compelling problems, more people will be interested in learning about this.”
In June 2023, Eskandarian was awarded a National Science Foundation CAREER Award. The CAREER program supports junior faculty who exemplify the role of teacher-scholars through outstanding research, excellent education, and the integration of education and research within their organizations.
The five-year grant, worth $516,082, will be used for his research on improving the process of reporting abusive content and the development of educational materials on these topics.
“We value privacy, we value safety, and these things seem to be at odds,” he says. “I love these cases where there’s a hard puzzle and cryptography potentially offers a way to cut the Gordian knot.”