Service center

Amazon launches encrypted communication service AWS Wickr

A year after acquiring Wickr, Amazon recently announced the preview of the AWS Wickr collaborative suite. Built on a proprietary encryption protocol, the new managed service provides businesses and government agencies with security and administrative controls to meet security and compliance requirements.

Wikcr uses AES-256 multi-layer end-to-end encryption and key management protocols to allow users to securely share critical information. Every call, message, and file in AWS Wickr is encrypted with a new random encryption key and new messages. According to the cloud provider, encryption keys are only accessible within Wickr apps and are not leaked to Wickr servers.

Among suggested use cases, the new service can help secure sensitive communications and enable out-of-band communications for disaster recovery and incident response, facilitate data governance, and enable internal and external collaboration through federation. . After acquiring the company that creates end-to-end encryption-based collaboration solutions for public sector and enterprise customers, Amazon integrated Wickr as an AWS service and developed new features, including a new SDK and updated encryption protocols.

Even though AWS claims it cannot access communications, the choice of a proprietary protocol has raised some concerns in the community. Christophe Tafani-Dereeper, cloud security researcher and lawyer at Datadog, comments:

“AWS Wickr encrypts every message, call, and file with a proprietary 256-bit end-to-end encryption protocol.” It reads awfully “we’re launching our own encryption.”

Source: https://aws.amazon.com/wickr

EJ Campbell, vice president of engineering at Yahoo Sports, tweet:

Is a proprietary protocol a good thing?

With the ability to operate in low-bandwidth environments, Wickr has evolved in recent years from an app used by privacy advocates to an encrypted chat platform for the US military and government agencies. The new business model has raised doubts among some users @AL_Capone_MMA write in a long thread on twitter the different reasons not to use Wickr for private communications:

It would seem that the majority of Wickr’s revenue comes from government contracts (…) The Air Force has spent millions on the encrypted app. Do these types of contracts make Wickr more likely to cooperate with authorities?

The cloud provider recently released the AWS Wickr ATAK plugin that allows users to monitor the location of other users and potential dangers. Designed for use in combat zones, the Team Awareness Android Kit provides mapping, messaging, and geofencing functionality. In a post on the public sector blog AWS, the cloud provider announced the availability for the US Department of Defense of Wickr RAM, a fully-featured, end-to-end encrypted collaboration application designed for the warfighter. Scott Piper, Cloud Security Consultant, comments:

Interesting. Looks like AWS’s acquisition of Wickr was intended for military use cases.

AWS Wickr preview requires registration and the service is available for free during the preview period.