There is no single or final group key. Each group participant has its own
Sender key. Whenever a new member joins a group, it generates its own
Chain key and
Signature key pair. It combines the Chain key and
public Signature key into a Sender key and distribute it to all the group participants using the pairwise direct messaging.
All the other group participants already have their own Sender key and they share it with the new participant through pairwise messaging. In this way, everyone keeps the Sender key of each other. Sender key is decomposed to
Chain key and
public Signature key once it is exchanged.
Now if a sender wants to send a group message:
It derives a
Message key from Chain key as:
HMAC-SHA256 = (Chain key, 0x01)
And updates the Chain key as:
HMAC-SHA256 = (Chain key, 0x02)
It encrypts the group message with the Message key using
- It signs the message with its
private Signature key.
Then it sends the message to the server. The server creates copies of the cipher text and sends it to every member. This is called server-side fan-out.
Upon receiving the message, group members use sender's
public Signature key to verify the message, derive the Message key, update the Chain key the same way as the sender did, decrypt the message and delete the Message key.
Now if the sender wants to send another message, he will derive a new Message key from the updated Chain key. The earlier Message key is deleted.
The problem with this design is that it doesn't offer perfect future secrecy. If a Chain key of a specific group member is compromised any future message which is sent by that particular member will also get compromised. It is only using symmetric ratchet instead of using double ratchet as in pairwise direct messaging.
Computerphile has also made a good video on this - What's Up With Group Messaging?