7.2 Enhanced Encryption

When a Zoom client gains entry to a Zoom meeting with enhanced encryption, it gets a 256-bit per-meeting key (MK) generated by the Zoom server, which retains the key to distribute it to participants as they join. During meetings, each participant might produce different data streams such as audio, video and screen sharing. Since Zoom client version 5.0, each stream consists of UDP packets that are encrypted (in both enhanced and endto-end encrypted meetings) using AES-GCM with a unique per-stream key, derived from the meeting key and a (non-secret) stream identifier using HMAC. Those packets are relayed and multiplexed via one or more Multimedia Routers (MMR) in Zoom’s infrastructure. The MMR servers do not decrypt these packets to route them, and use the per-meeting key only to provide the special features (such as PSTN dial-in and Cloud Recording) as detailed below. There is also no mechanism to re-key a meeting. If a PSTN or SIP client is authorized to join, the MMR provides the per-meeting encryption key to specialized connector servers in Zoom’s infrastructure. These servers act as a proxy: they decrypt and composite the meeting content streams in the same manner as a Zoom client and then re-encode the content in a manner appropriate for the connecting client. Zoom’s optional Cloud Recording feature works similarly, recording the decrypted streams and hosting the resulting file in Zoom’s cloud for the user to access. In the current design, Zoom’s infrastructure brokers access to the meeting key. This design provides confidentiality and authenticity for all Zoom data streams by providing encryption between Zoom client endpoints and the servers. However, it does not provide end-to-end key management. In meetings using enhanced encryption, a passive adversary who has access to the memory of the relevant Zoom servers may be able to breach confidentiality, by observing the shared meeting key, deriving session keys, and decrypting all meeting data. Zoom meetings with enhanced encryption, as well as virtually every other cloud product, rely on securing the server infrastructure in order to achieve overall security; end-to-end encryption, using keys at the endpoints only, allows us to reduce reliance on the security of the Zoom infrastructure.