X Launches End-to-End Encrypted Chat: Use with Care.

X, formerly known as Twitter, has initiated the launch of a new encrypted messaging feature called “Chat” or “XChat.”

The platform claims that this feature is end-to-end encrypted, indicating that only the sender and recipient can access the messages, without X or any third party being able to read them.

Yet, cryptography experts warn that the current encryption implementation in XChat is not dependable. They assert that it does not meet the standards set by Signal, which is recognized as the gold standard for end-to-end encrypted messaging.

When a user clicks “Set up now” in XChat, they are prompted to create a 4-digit PIN, which encrypts the user’s private key stored on X’s servers. This key is a secret cryptographic element assigned to users for decrypting messages. In end-to-end encrypted services, a private key works in conjunction with a public key, which a sender uses to encrypt messages intended for the receiver.

This raises an important concern for XChat. Unlike Signal, which retains the user’s private key on their device, X’s method of storing private keys on its servers is questionable.

Matthew Garrett, a security researcher who authored a blog post about XChat in June, pointed out that if the company doesn’t employ Hardware Security Modules (HSMs) to store the keys, it may be able to manipulate them, allowing for potential decryption of messages. HSMs are specifically designed to restrict access to the data they contain for the owning company.

An engineer from X claimed in June that HSMs are in use; however, neither he nor the company has provided any confirming evidence. “Until then, this is ‘trust us, bro’ territory,” Garrett remarked to TechCrunch.

A second concern addressed by X on the X Chat support page is that the current setup could allow “a malicious insider or X itself” to breach encrypted conversations.

This situation is related to an “adversary-in-the-middle” (AITM) attack, which undermines the fundamental purpose of an end-to-end encrypted messaging service.

Garrett stated that X “provides you the public key every time you interact with them, so even if they’ve done this correctly, you can’t prove they haven’t created a new key,” which could facilitate an AITM attack.

Another issue is that none of XChat’s implementation is currently open source, in contrast to Signal’s comprehensive public documentation. X has stated its intention to “open source our implementation and offer detailed technical documentation about the encryption technology later this year.”

Finally, XChat lacks “Perfect Forward Secrecy,” a cryptographic feature that ensures each message is encrypted with a distinct key. This limitation implies that if an attacker obtains the user’s private key, they can decrypt only the latest message rather than all previous ones. The company itself acknowledges this drawback.

Because of these concerns, Garrett believes XChat is not yet secure for users.

“If all parties are entirely trustworthy, the X implementation is technically inferior to Signal,” Garrett told TechCrunch. “And even if they were completely reliable at first, there’s a risk they could later compromise this trust in various ways […] If they were untrustworthy or incompetent from the outset, proving any security becomes impossible.”

Garrett is not alone in his apprehensions; Matthew Green, a cryptography expert at Johns Hopkins University, shares similar views.

“For now, until it is thoroughly audited by a credible entity, I wouldn’t trust this any more than I would expect from current unencrypted DMs,” Green told TechCrunch. (XChat currently functions alongside traditional Direct Messages.)

X did not respond to several inquiries sent to its press contact.