…In order to precisely understand the confidentiality guarantees that MLS enjoys, we must explain the two notions of post-compromise security and forward secrecy. To read this blog post, your web browser used the TLS protocol to establish a secure connection with my web server, which probably took less than a second. Group messaging is a different beast: the protocol runs for a long period, sometimes several years. Secure group messaging protocols must therefore account for the possibility that one of the devices is stolen or compromised during the lifetime of the conversation. Forward Secrecy (FS) and Post-Compromise Security (PCS) refine the confidentiality property: they state what happens to confidentiality when a device is compromised by an attacker. Forward secrecy means that even if private keys become known to an attacker, they still can’t decrypt messages that were sent in the past. In other words, confidentiality of messages you send now are not affected by future leak of private keys. Post-compromise security is the “reverse” of forward secrecy : even if private keys become known to an attacker, they still can’t decrypt messages that will be sent in the future, after some period of healing (where those private keys will be replaced by new ones). In other words, confidentiality of messages you send now are not affected by previous leak of key material.…