Signal Sender Keys: Why it works and which is the common key at the end?

As I has read upon "WhatsUp Encryption Overview" when a client receives a sender message then it performs the following actions:

1. Decomposes Sender Message to Chain Key and Signature Key.
2. Generates a Message Key from a Chain Key and update the Chain Key.
3. The sender encrypts the message using AES256 in CBC mode and signs it with Signature key.
4. The sender transmits the single ciphertext message to the server, which does server-side fan-out to all group participants.

So I wonder at the end which is the final group key each participant, as far as I understand has a single key so how others on a group chat are able to decrypt the message?

Also I cannot understand at step 2 which key is used in order to encrypt the message in AES CBC Mode?

Also how Chain Key is updated? As some sort of a DKF function is used to concat all single keys into one master key?

• I've got a lot of trouble reading your messages. Could you possibly read it again (imagine you're the one receiving the post). Things like "So I wonder at the end which is the final group key each participant as far as I understand has a single key so how others on a group chat are able to decrypt the message?" should definitely not be a single sentence. – Maarten Bodewes Sep 25 '18 at 15:53
• Thanks for taking my comment seriously, but the insertion of the comma alone doesn't do it for me. (Note that I may remove these comments later on; they are not important for readers question, just the formatting. Others may understand the question well even if I don't). – Maarten Bodewes Sep 26 '18 at 11:43

There is no single or final group key. Each group participant has its own Sender key. Whenever a new member joins a group, it generates its own Chain key and Signature key pair. It combines the Chain key and public Signature key into a Sender key and distribute it to all the group participants using the pairwise direct messaging.

All the other group participants already have their own Sender key and they share it with the new participant through pairwise messaging. In this way, everyone keeps the Sender key of each other. Sender key is decomposed to Chain key and public Signature key once it is exchanged.

Now if a sender wants to send a group message:

• It derives a Message key from Chain key as:

HMAC-SHA256 = (Chain key, 0x01)

• And updates the Chain key as:

HMAC-SHA256 = (Chain key, 0x02)

• It encrypts the group message with the Message key using AES256 in CBC mode.

• It signs the message with its private Signature key.

Then it sends the message to the server. The server creates copies of the cipher text and sends it to every member. This is called server-side fan-out.

Upon receiving the message, group members use sender's public Signature key to verify the message, derive the Message key, update the Chain key the same way as the sender did, decrypt the message and delete the Message key.

Now if the sender wants to send another message, he will derive a new Message key from the updated Chain key. The earlier Message key is deleted.

The problem with this design is that it doesn't offer perfect future secrecy. If a Chain key of a specific group member is compromised any future message which is sent by that particular member will also get compromised. It is only using symmetric ratchet instead of using double ratchet as in pairwise direct messaging.

Computerphile has also made a good video on this - What's Up With Group Messaging?

• on your schema is the Constant used as Message Identifier to derive a Message Key? – Dimitrios Desyllas Feb 6 at 16:45
• Constant is an optional value. By default, it is set to all zeroes. But it is definitely not used as message identifier. – defalt Feb 6 at 16:50
• Now I wonder what is the penalty for forward secrecy, is per user forward secrecy but not as a whole unit? – Dimitrios Desyllas Feb 6 at 17:00
• @Dimitrios Desyllas I made an edit to answer this. – defalt Feb 6 at 17:16
• @Dimitrios Desyllas That constant is an increment. 0x01, 0x02.. – defalt Feb 7 at 10:59