One way of implementing end-to-end encrypted group chats is simply to consider it as a collection of pairwise channels. For example, in a group of Alice, Bob, and Charlie, Alice will send a message by encrypting it separately for Bob and Charlie. This means that group chats retain all the security properties of pairwise channels (e.g. forward secrecy, post-compromise security).
This is how iMessage treats group chats, but it has some downsides when sending large files: encrypting and uploading e.g. an image separately for each group member is CPU- and bandwidth-intensive and does not scale well.
I am wondering whether a solution to this might be to use pairwise channels for text messages, but for media attachments:
- generate a symmetric key
- send this key to every group member (along pairwise channels)
- upload encrypted media (just once)
Since a new key would be used for each media attachment, I think this would retain the security properties of the group chat. Are there any downsides to this performance optimization?
