Analyzing Group Chat Encryption in Messaging Applications

  • Akshaya Kumar, Georgia Institute of Technology; Melissa Chase, Microsoft

Secure group messaging applications have been widely deployed to protect the conversations of billions of users. Several academic works have analyzed the cryptographic security of these applications, but most of them focus on analyzing the more “novel” key agreement primitive. Due to the inherent complexities, few works analyze an application as a whole, and even fewer focus on the chat encryption primitive specifically. We formalize security goals for group chat encryption which combines symmetric encryption and digital signatures. We use our formalism to analyze two deployed protocols and identify practical attacks against the MLS and Session protocols that allow a group member to impersonate another by replaying their messages. Additionally, we found Session to be susceptible to message re-ordering attacks by non-group members such as the platform server. Independent analysis of chat encryption allowed us to narrowly target the corresponding security goals and specify a set of conditions required for proper binding between the signing and encryption components. Because of our work, developers of group chat encryption algorithms need only check that these conditions are met to ensure that the security goals are achieved.

Series: Cryptography Talk Series