7
$\begingroup$

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group.

Whatsapp also limits group size to 256 members, making the above feasible.

Can we do better? To support significantly larger groups? While maintaining end to end encryption? Will we be able to still maintain other properties, like forward secrecy?

$\endgroup$
  • 1
    $\begingroup$ Well, you could always use one static symmetric key for the whole group and update it using a conference DH agreement whenever somebody joins or leaves.... $\endgroup$ – SEJPM Mar 23 '18 at 9:58
  • $\begingroup$ That would mean if someone leaves no one can send a message until everyone becomes online and active so the new key exchange can complete. $\endgroup$ – Meir Maor Mar 23 '18 at 10:19
  • $\begingroup$ @MeirMaor I linked to an asynchronous group-DH that does not rely on all members being online to setup, or progress. Although having a server to resolve conflicting updates will certainly help and should not be an issue for the Signal/Whatsapp model, apparently this is an issue for Matrix because it is decentralized. $\endgroup$ – cypherfox Mar 23 '18 at 11:32
4
$\begingroup$

Can we do better?

Yes. See: On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees.

To support significantly larger groups?

Our results demonstrate that ART is practical for reasonably-sized groups, with key tree setup and message sending both taking a few milliseconds for groups of size ten and on the order of one second for groups of size 1000.

While maintaining end to end encryption? Will we be able to still maintain other properties, like forward secrecy?

The important property that we care about here is Post-Compromise Security (PCS), defined as:

Moreover, some modern messaging protocols offer a property called Post-Compromise Security (PCS), sometimes referred to as “future secrecy” or “self-healing”. For PCS, even after Alice’s device is entirely compromised by an adversary, she may later be able to establish secure communications with others after a single unintercepted exchange.

comparison table

These trees establish new group shared keys when any member joins or leaves the group, or when each member decides to rotate their key. In double-ratchet keys usually rotate after the first message from each user since the key changed, although some implementations, specifically Matrix' Olm, opt to be less noisy; re-keying every N-messages or after T-seconds.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.