In the past few years secure messaging has become mainstream, with over a billion active users of end-to-end encryption protocols such as Signal. The Signal Protocol provides a strong property called post-compromise security to its users. However, it turns out that many of its implementations provide, without notification, a weaker property for group messaging: an adversary who compromises a single group member can read and inject messages indefinitely. We show for the first time that post-compromise security can be achieved in realistic, asynchronous group messaging systems. We present a design called Asynchronous Ratcheting Trees (ART), which uses tree-based Diffie-Hellman key exchange to allow a group of users to derive a shared symmetric key even if no two are ever online at the same time. ART scales to groups containing thousands of members, while still providing provable security guarantees. It has seen significant interest from industry, and forms the basis for two draft IETF RFCs and a chartered working group. Our results show that strong security guarantees for group messaging are practically achievable in a modern setting. • Security and privacy → Security protocols; Cryptography; Formal methods and theory of security; Formal security models; Mobile and wireless security; KEYWORDS end-to-end encryption; ART; group messaging; tree Diffie-Hellman; security protocols; computational proof; verification Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). CCS '18, October 15-19, 2018, Toronto, ON, Canada
Asynchronous Ratcheting Trees (ART) REF describes a group key agreement protocol with forward and backward-Post Compromisesecrecy.
On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees
CCS '18
Computer Science