How does future secrecy fail for Signal group messaging?

Question

In the paper More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema, the abstract claims that

We additionally show that strong security properties, such as Future Secrecy which is a core part of the one-to-one communication in the Signal protocol, do not hold for its group communication.

Failure of future secrecy makes sense for Whatsapp and Threema, since Threema uses a static key and Whatsapp uses a single symmetric key ratchet for group messaging, both of which are vulnerable to session state compromise. However, the paper states that Signal uses a normal double ratcheting scheme for group messaging such that group messages are indistinguishable from pairwise messages.

How does future secrecy fail for group messaging when the session state is refreshed whenever the keys are ratcheted?

Note: It seems that future secrecy fails due to the ability to join a group just by knowing its GroupID. Assuming that group update messages are properly authenticated, does future secrecy still fail for Signal's group messaging?

Answer 1

Note: It seems that future secrecy fails due to the ability to join a group just by knowing its GroupID.

Correct, this seems to be the issue. Since an attacker can join a group by learning some of the session states and thereafter compromise all messages due to being a part of the group, the group protocol lacks future secrecy.

From the paper (page 8 of the pdf): "After adding herself to the group, the confidentiality of future plaintext messages is compromised."

Assuming that group update messages are properly authenticated, does future secrecy still fail for Signal's group messaging?

Due to the use of the double ratchet, it would retain that property if knowing the session state would not allow joining the group. But details matter in achieving that. It is not sufficient to just authenticate the group update since we are talking about a situation where the keys of one party are compromised.

However, you are right that it seems to be only the group administration that needs to be fixed.