HTTP Group Message Encryption with Rotating Per-Message Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing messaging applications face inefficiencies in web-based environments due to the rigid formatting requirements of the MLS protocol, making it difficult to securely transmit encrypted messages to multiple recipients using JavaScript in web browsers.
Innovation Solution
An end-to-end mechanism for encrypting messages using unique keys for each user in a group, stored in a binary tree structure, and transmitting them over HTTP, allowing for flexible formatting and secure decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MLS protocol encryption is used for group communications, then security is improved, but formatting rigidity and incompatibility with web-based environments worsen
Solution Approach 1:
The message data is segmented into distinct fields (message_id, sender_id, recipient_ids, timestamp, encrypted_payload) with explicit type definitions. This segmentation allows the encrypted data to be structured in a web-compatible format while maintaining security, resolving the contradiction between MLS security requirements and web environment adaptability
Solution Approach 2:
The encryption implementation changes from strict MLS protocol formatting to a flexible JSON-based structure with typed fields. This parameter change in data representation allows the same encryption functionality to work in web environments with JavaScript, achieving both security and adaptability
2Reliability
If one encryption key is compromised, then security is weakened, but with unique keys per message the security impact is limited to single messages
Solution Approach 1:
Encryption keys are generated and stored in advance in a binary tree structure within the web browser's secure storage. This preliminary action allows messages to be encrypted with unique keys without real-time key generation complexity, achieving security resilience while managing complexity through pre-computation
Solution Approach 2:
A binary tree structure acts as an intermediary between the key generation secret and individual message encryption keys. This intermediary structure enables efficient key derivation and management, providing security resilience against key compromise while reducing the operational complexity of managing unique keys per message
3Reliability
If encrypted messages are stored in MLS protocol format, then encryption security is maintained, but efficiency in web-based environments deteriorates
Solution Approach 1:
Instead of storing messages in native MLS protocol format, the system creates a web-compatible copy with the same security properties using JSON with typed fields. This copying approach maintains encryption security while dramatically improving processing efficiency in JavaScript-based web environments
Solution Approach 2:
The strict MLS protocol formatting mechanism is replaced with a more flexible JSON-based typing system that is native to web environments. This substitution maintains the essential security function while improving processing efficiency by eliminating protocol parsing overhead and enabling direct JavaScript object manipulation
Data Source
AI summary
An end-to-end mechanism is disclosed herein for transporting encrypted messages over hypertext transport protocol (HTTP) sent to a group of recipients. In particular, the disclosed mechanism receives a message (e.g., as an input from a user) and encrypts that message using an encryption mechanism with a key unique to a particular user and to the message (e.g., different messages are encrypted using different keys). The encrypted message is then stored in a generated object along with other metadata needed for message processing. Once the object is generated, it is signed and encoded into a binary representation that is then sent to a server. The server system receives the binary representation and decodes it back into the object. The metadata of the object is then used to route the message to the correct recipient applications for decryption.