In May 2024, Meta engaged NCC Group’s Cryptography Services practice to perform a cryptography security assessment of selected aspects of the WhatsApp Identity Proof Linked Storage (IPLS) protocol implementation. IPLS underpins the WhatsApp Contacts solution, which aims to store a WhatsApp user’s in-app contacts on WhatsApp servers in a privacy-friendly way. WhatsApp servers do not have visibility into the content of a user’s contact metadata. The user can later retrieve these contacts from WhatsApp servers to a new device where they re-register their WhatsApp account using the same phone number. The IPLS protocol makes use of Hardware Security Modules (HSMs) and an Auditable Key Directory (AKD).