Messaging Layer Security (MLS) is a security layer for encrypting messages in groups of two to many sizes.
The news was released that the IETF Committee (Internet Engineering Task Force), which develops the protocols and architecture of the Internet, approved the publication of the MLS standard (Messaging Layer Security), which defines a protocol for organizing end-to-end encryption in messaging applications.
Be supposed to MLS promotion will unify end-to-end encryption mechanisms of messages in groups that cover two or more participants and will simplify the implementation of its support in applications.
The IETF approved the publication of Messaging Layer Security (MLS), a new standard for end-to-end security that will make it easier for applications to provide the highest level of security to their users. End-to-end encryption is an increasingly important security feature in Internet applications. It keeps users' information safe, even if the cloud service they are using has been breached.
Documents describing the MLS architecture and the protocol used to encrypt messages have been posted for your review.
The implementations of MLS are being developed in C++, Go, TypeScript, and Rust. The development of MLS is based on the experience of existing protocols used to secure message transmission, such as S/MIME, OpenPGP, Off the Record, and Double Ratchet.
Specification preparation, operational implementation, and verification procedures are carried out in parallel, using the methods used in the preparation of the TLS 1.3 standard.
Such an approach will allow several compatible and tested implementations of the protocol for when the RFC is ready. MLS implementations are currently in production on the Webex and RingCentral communications platforms, and Wickr and Matrix also plan to migrate to MLS.
MLS is based on the best lessons from the current generation of security protocols. Like the widely used Double Ratchet protocol, MLS enables asynchronous operation and provides advanced security features such as post-compromise security. And, like TLS 1.3, MLS provides strong authentication, and its security properties have been verified through formal testing. MLS combines the best features of these predecessors and adds features like efficient scaling to conversations involving thousands of devices without sacrificing security.
It is mentioned that the main objective to create a new protocol is the unification of means for end-to-end encryption and the introduction of a single standardized protocol and verified that it can be used instead of separate protocols developed by different manufacturers that solve the same tasks, but are not mutually compatible.
In addition to this, it is also noted that MLS will allow the use of ready-to-use implementations of the protocol already tested in different applications, as well as organize their joint development and verification.
It is worth mentioning that application level portability is planned to be implemented at the authentication, key derivation and privacy level (transport and semantic level compatibility is outside the scope of the standard).
Regarding the tasks resolved by the protocol, the following are mentioned:
- Privacy: messages can only be read by members of the group.
- Integrity and authentication guarantees: each message is sent by an authenticated sender and cannot be tampered with or altered en route.
- Authentication of group members: each member can verify the authenticity of other members of the group.
- Asynchronous operation – Encryption keys can be exposed without the need for both parties to be online.
- Forward Secrecy: compromising one of the participants does not allow decrypting the messages previously sent to the group.
- Post-compromise protection: Compromise of one of the participants does not allow decryption of messages that will be sent to the group in the future.
- Scalability: When possible, sublinear scalability in terms of resource consumption based on pool size.
Finally If you are interested in knowing a little more about it, you can check the details in the following link.