LINE-Break: Cryptanalysis and Reverse Engineering of Letter Sealing

We present a security analysis of the messaging service known as LINE, a popular platform used daily by millions of users in East Asia – most notably Japan, Taiwan, Thailand, and Indonesia. More specifically, we focus on its underlying custom end-to-end-encryption (E2EE) protocol known as Letter Sealing v2, which we evaluate with respect to modern E2EE security guarantees. Our findings show that Letter Sealing allows a TLS Man-in-the-Middle attacker or malicious server to violate integrity, authenticity and confidentiality of communications. The stateless design of the protocol allows message replay, reordering, and blocking attacks, compromising the transcript consistency of communications. The lack of origin authentication facilitates impersonation attacks, in which the authorship of messages in one-to-one or group chats can be forged by malicious users colluding with the adversary. Lastly, stickers, a main selling point of the application, present a notable plaintext leakage, which leads to violation of confidentiality. To verify the correctness of our findings, we mounted a Man-in-the-Middle attack on an iOS device, yielding the device’s outgoing traffic and the corresponding server responses. Utilizing this setup, we experimentally verified our attacks against the authentic LINE application. We discuss our findings in comparison to the state-of-the-art E2EE protocol Signal, and conclude that Letter Sealing does not satisfy the requirements expected from a modern E2EE messaging protocol. This is joint work with Adam Blatchley Hansen.

Date
Dec 11, 2025
Location
Excel London, UK