Encrypted messaging web app design

Question

I’m implementing an encrypted messaging web app using JS. When composing a message, the user is provided with the public key of the recipients. A body field is also rendered for every recipient. After the user clicks submit, the original message is encrypted with the recipients’ public keys, which is then inserted into their respective body fields.

Since every user has their own body field (the ciphertext varies between users), a malicious user could write a different message for every recipient. How should I go about tackling this problem?

Answer 1

Include sender and receiver in the plaintext message (you need some kind of message format for that) and also sign the message (including sender / receiver) before encryption. That way an attacker cannot alter or swap the plaintext message. You may also need to assign the message a number of include some kind of timestamp to avoid replay attacks.

You could encrypt the message first using a message key and encrypt that key using the various public keys of the receivers. Note that the encryption scheme should not fall to plaintext / padding oracle attacks, as the signature should be over the plaintext, not the ciphertext.

Answer 2

Use the Signal Protocol. It is the protocol used by apps such as Signal itself, and is trusted by such people as Edward Snowden.

Answer 3

you should not encrypt plaintext message using public key. You may do following

1. select a random 128, 192, or 256 bit key
2. use a symmetric cipher to encrypt plaintext message using that key (you may also compress the message before encryption)
3. encrypt the key with public keys of the recipient
4. you should also consider signing the plaintext
5. include a timestamp of incremental message number to avoid replay attacks

as mentioned in another answer, Signal Protocol is a good guide line about it or you can read Whatsapp End to End Security document.