> For the complete documentation index, see [llms.txt](https://web-zoom.gitbook.io/zoom/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://web-zoom.gitbook.io/zoom/contents.md).

# Contents

### **1. Introduction** <a href="#id-1.-introduction" id="id-1.-introduction"></a>

*1.1 Outline 1.1.1 E2E Encryption for Zoom Meetings*

### 2. Background and Security Goals <a href="#id-2.-background-and-security-goals" id="id-2.-background-and-security-goals"></a>

*2.1 Limitations*

### 3. User Identity and Key Management <a href="#id-3.-user-identity-and-key-management" id="id-3.-user-identity-and-key-management"></a>

*3.1 Non-Cryptographic Identity at Zoom*

*3.2 Cryptographic User Identity*

*3.3 Displaying Identity*

*3.3.1 Identifying Accounts*

*3.3.2 Identifying Users*

*3.4 Multi-Device Support*

*3.4.1 Per-User Keys*

*3.4.2 Backup Keys*

*3.4.3 Escrow Keys*

*3.4.1 Lockdown Mode*

*3.5 Consistent Identities With Sighchains*

*3.5.1 Sighchains*

*3.5.2 Overview of Sighchain Types*

*3.5.3 User Sighchains*

*3.5.4 Email Sighchains*

*3.5.5 Account Sighchains*

*3.5.6 ADN Sighchains*

*3.5.7 Membership Sighchains*

*3.6 Sighchain Fingerprints*

*3.7 Client Key Management*

*3.7.1 Storing Secret Keys on Device*

*3.7.2 Device Management Interface*

*3.8 Account Escrow*

*3.8.1 Escrow Administrators and the EA Sighchain*

*3.8.2 Users’ Escrow Device Management*

*3.8.3 EA Permissions*

*3.8.4 User Recovery*

*3.8.5 Legal Discovery*

*3.9 Highlighting Untrusted Devices with Contact Sync*

*3.10 Compromise Prevention for Device Provisioning*

*3.11 Security Properties*

*3.11.1 MitM Between a User’s Devices*

*3.11.2 MitM Between Different Users*

*3.11.3 Integrity*

*3.11.4 Security Limitations*

*3.11.5 Privacy Limitations*

### 4. Transparency Tree <a href="#id-4.-transparency-tree" id="id-4.-transparency-tree"></a>

*4.1 Zoom Transparency Tree*

*4.2 Integration Details*

*4.2.1 ZTT Auditing*

*4.2.2 Provisioning*

*4.2.3 Self-Audit and Refresh*

*4.2.4 Validating User Identity*

*4.2.5 Contact List Updates*

*4.3 Security Properties*

*5 Identity Provider Attestations*

*5.1 Associating Accounts with Identity Providers*

*5.2 IDP Attestations 5.3 Updating Snapshots*

*5.4 Validating IDP Attestations*

*5.5 Zoom Identity Snapshots*

*5.6 Security Properties*

### *6. Encryption for Zoom Mail Service* <a href="#id-6.-encryption-for-zoom-mail-service" id="id-6.-encryption-for-zoom-mail-service"></a>

*6.1 Encrypted Email Protocol*

*6.2 Emails to Users without Devices*

*6.3 Emails to and from External Users*

*6.4 Mailing Lists 6.5 Calendar Email Integration*

*6.6 Encrypting Non-Email Data*

*6.7 Security Properties*

*6.7.1 Spam Detection and Contact Monitoring*

### 7. Encryption for Zoom Meetings <a href="#id-7.-encryption-for-zoom-meetings" id="id-7.-encryption-for-zoom-meetings"></a>

*7.1 Zoom Meetings*

*7.2 Enhanced Encryption*

*7.3 End-to-End Encryption*

*7.3.1 Security Goals*

*7.4 System Components*

*7.5 Cryptographic Algorithms*

*7.5.1 Signing*

*7.5.2 Authenticated Public-Key Encryption*

*7.6 Join/Leave Protocol flow*

*7.6.1 Server Key Certificate Chains*

*7.6.2 Participant Key Generation*

*7.6.3 Leader Join*

*7.6.4 Participant Join (Leader)*

*7.6.5 Participant Join (Non-Leader)*

*7.6.6 Key Rotation*

*7.6.7 Leader Participant List*

*7.6.8 Liveness*

*7.6.9 Locked Meetings*

*7.6.10 Meeting Teardown*

*7.7 Meeting Leader Security Code*

*7.8 E2E Encryption for Breakout Rooms*

*7.9 Abuse Management and Reporting*

*7.10 IDP Attestations for E2EE Meetings*

*7.11 E2EE Meetings with Cryptographic Identity*

*7.12 Security Properties for E2EE Meetings*

*7.12.1 Areas to Improve*

### 8. Encryption for Zoom Phone <a href="#id-8.-encryption-for-zoom-phone" id="id-8.-encryption-for-zoom-phone"></a>

*8.1 E2EE Zoom Phone Calls*

*8.1.1 Join/Leave Protocol*

*8.1.2 Phone Security Code*

*8.2 Advanced Encryption for Voicemail*

*8.2.1 Security Properties*

### A. Release Schedule <a href="#a.-release-schedule" id="a.-release-schedule"></a>

B Understanding Multiple Devices

B.1 A Claim about Device Equivalence Classes

### C. Cake-AES <a href="#c.-cake-aes" id="c.-cake-aes"></a>

C.1 Encryption

C.2 Decryption

C.3 Random-Access Decryption