探索加密键盘以击败端到端加密系统中的客户端扫描
Exploring Encrypted Keyboards to Defeat Client-Side Scanning in End-to-End Encryption Systems
AI总结：
本文提出一种作为系统键盘运行的加密键盘，使用户能在本地加密和解密消息，从而绕过客户端扫描（CSS），并在现有端到端加密应用之上增加额外一层 E2EE 保护。
摘要：
端到端加密（E2EE）旨在使所有消息除您和您的预期接收者外，任何人都无法读取。许多知名且广泛使用的即时通讯（IM）应用（如 Signal、WhatsApp 和 Apple 的 iMessage）声称提供 E2EE。然而，一种最近出现的技术——客户端扫描（CSS）使这些 E2EE 声明变得夸大而空洞。CSS 是一种对从一端到另一端的所有发送和接收消息进行扫描的技术。如今，工业界和政府中的一些人提倡使用这种 CSS 技术来打击恶意儿童色情、恐怖主义和其他非法通信的增长。尽管打击非法和道德上令人反感的内容传播是一项值得称赞的努力，但它可能打开更多影响用户隐私和安全的“后门”。因此，当端到端加密应用中存在审查机制和后门时，它就不再是 E2EE。在本文中，我们介绍了一种加密键盘，它作为系统键盘运行，使用户在手机上输入数据时能够在所有应用中使用它。通过利用这种加密键盘，用户可以在本地加密和解密消息，从而有效绕过 CSS 系统。我们首先将我们的加密键盘设计和实现为一个自定义键盘应用，然后评估我们的加密键盘的有效性和安全性。我们的研究结果表明，我们的加密键盘能够成功加密和解密通过 IM 应用发送和接收的所有消息，因此它能够成功击败端到端加密系统中的 CSS 技术。我们还表明，我们的加密键盘可用于在许多端到端加密应用已实现的现有 E2EE 功能之上，再增加一层 E2EE 功能。
英文摘要：
End-to-End Encryption (E2EE) aims to make all messages impossible to read by anyone except you and your intended recipient(s). Many well-known and widely used Instant-Messaging (IM) applications (such as Signal, WhatsApp, and Apple's iMessage) claim to provide E2EE. However, a recent technique called client-side scanning (CSS) makes these E2EE claims grandiose and hollow promises. The CSS is a technology that scans all sending and receiving messages from one end to the other. Some in industry and government now advocate this CSS technology to combat the growth of malicious child pornography, terrorism, and other illicit communication. Even though combating the spread of illegal and morally objectionable content is a laudable effort, it may open further backdoors that impact the user's privacy and security. Therefore, it is not E2EE when there are censorship mechanisms and backdoors in end-to-end encrypted applications. In this paper, we introduce an encrypted keyboard that functions as a system keyboard, enabling users to employ it across all applications on their phones when entering data. By utilizing this encrypted keyboard, users can locally encrypt and decrypt messages, effectively bypassing the CSS system. We first design and implement our encrypted keyboard as a custom keyboard application, and then we evaluate the effectiveness and security of our encrypted keyboard. Our study results show that our encrypted keyboard can successfully encrypt and decrypt all sending and receiving messages through IM applications, and therefore, it can successfully defeat the CSS technology in end-to-end encrypted systems. We also show that our encrypted keyboard can be used to add another layer of E2EE functionality on top of the existing E2EE functionality implemented by many end-to-end encrypted applications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
