To what extent is WhatsApp's statement on secure messaging realistic? As those of you who use WhatsApp Messenger probably know, with their recent update chats and calls are now encrypted. Here's what WhatsApp claims:


  Messages you send to this chat and calls are now secured with
  end-to-end encryption, which means WhatsApp and third parties can't
  read or listen to them.


Now let's put aside how WhatsApp is honest but what they claim is a technological feature. Is it really not possible for them to read or listen to our messages? If that's a lie, then  don't they risk that some guys like you might say "Hey, what the hell are you talking about? Why do you lie?". So my question is, if they are the ones who encrypt this, then why can't they also decrypt it?
So my question is, if they are the ones who encrypt this, then why can't they also decrypt it?


Because it’s not them encrypting your message, it’s the App on your device… which is why it’s called End-To-End encryption.

According to the security whitepaper (PDF), WhatsApp uses the Noise Protocol Framework which is based on the Signal protocol (formerly known as “Axolotl”). The Signal protocol has been designed by Open Whisper Systems (names like “Zooko” might ring a bell) and  uses strong and well-vetted cryptographic approaches like ECDH using Curve25519. Besides that, WhatsApp additionally encrypts all communications between client and server via – so called – Noise Pipes (see Noise Protocol Framework for more information on that).

Skipping the details to keep it short, it seems as if WhatsApp did its homework and chose a well-vetted approach to provide encryption et al.

But there’s that little thing with WhatsApp that indeed represents a bit of a problem when looking at it from an InfoSec and/or cryptographic point of view: WhatsApp was, is, and remains closed source up until today. Practically, this means that you can’t really review the actual sourcecode and classify WhatsApp security based on that. So, you can’t really tell how much security it practically might (or might not) offer.

If you’ve ever looked at (or used) Signal as a messaging app, you’ll notice WhatsApp and Signal work in similar ways (read: usage-flow is very alike) which hints at the fact that WhatsApp has indeed implemented what it is saying. Yet, in contrast to Signal (which is open source) you can’t tell if WhatsApp has indeed implemented things correctly and without (let’s just call it) bugs in the code, which might or might not provide room for attack vectors.

All in all, your question uses the correct term: “claim”. That’s all it is and all you can trust in. A “claim” isn’t called “proof” for a good reason… in this case, you can not verify WhatsApp security claims by looking at WhatsApp sourcecode – as that’s unavailable to the public. All you have is their words (aka publications like the security whitepaper) and the fact that close-source WhatsApp somewhat feels like the open-source Signal app. In the realms of cryptography, small errors can (and will) break your neck – which is why I personally prefer to keep using Signal instead of switching to WhatsApp. OTOH, I’m weird… and there’s no real reason to suspect WhatsApp would even think about risking their business by publishing claims they can’t hold. Yet, they don’t provide much reason to trust them either. As Tylo commented correctly: it could all just be propaganda (aka marketing). In the end, it is a company with commercial interests and a close-source product… that somewhat renders “trust” into a “personal opinion” thing.

TL;DR

So, if your question boils down to “Is WhatsApp secure?” I would tend to say “According to their whitepaper, it should be”. If your question boils down to: “Can you prove it?” I’ld have to disappoint with a “No, as proof expects the ability to verify, which we can’t.” And if you want to know the details of “how WhatsApp handles End-To-End encryption and authentication”, check the security whitepaper and the Noise Protocol Framework links at the top of my answer. That should answer all those little cryptographic nit-bits (which are a bit too broad to mention here).