Decentralized authoritative messaging
A secure chat client is described that allows users to exchange encrypted communications via secure chat rooms, as well as one-to-one communications. In particular, the secure chat client allows users to create, configure, and manage secure chat rooms. Furthermore, the secure chat client provides users with the ability to recover secure messages when they obtain a new device or otherwise lose communications.
1. A method for transmitting an encrypted communication, the method comprising:
transmitting, by a first device, a request for a first public signing key of a second user, a second public signing key of the second user, and a first ephemeral public key to a first server;
receiving, by the first device, a response from the first server, wherein the response includes the first public signing key, the second public signing key, and the first ephemeral public key;
generating, by the first device, a second ephemeral asymmetric key pair;
generating, by the first device, a first communication encryption key;
encrypting, by the first device, a first communication using the first communication encryption key; and
transmitting, by the first device, the first encrypted communication to a second device of the second user, wherein the first encrypted communication includes the second ephemeral public key.
2. The method of claim 1 , further comprising:
encrypting, by the first device, the first communication encryption key using a key-encrypting key derived, in part, from the first ephemeral public key and the second ephemeral private key.
3. The method of claim 2 , further comprising:
transmitting, by the first device, the encrypted first encryption key with the first encrypted communication.
4. The method of claim 1 , wherein the first communication is encrypted with the first encryption key according to a symmetric encryption algorithm.
5. A system for transmitting an encrypted communication, the system comprising:
an interface configured to transmit a request for a first public signing key of a second user, a second public signing key of the second user, and a first ephemeral public key to a first server, receive a response from the first server, wherein the response includes the first public signing key, the second public signing key, and the first ephemeral public key, and transmit a first encrypted communication to a second device of the second user, wherein the first encrypted communication includes a second ephemeral public key;
a processor configured to generate, a second ephemeral asymmetric key pair, generate a first communication encryption key, and encrypt a first communication using the first communication encryption key; and
a memory coupled to the processor and the interface configured to provide the processor with instructions.
6. The system of claim 5 , wherein the processor is further configured to encrypt the first communication encryption key using a key-encrypting key derived, in part, from the first ephemeral public key and the second ephemeral private key.
7. The system of claim 6 , wherein the interface is further configured to transmit the encrypted first encryption key with the first encrypted communication.
8. The system of claim 5 , wherein the first communication is encrypted with the first encryption key according to a symmetric encryption algorithm.
9. A non-transitory computer-readable medium comprising instructions that when, executed by at least one processor, perform the steps of:
transmitting a request for a first public signing key of a second user, a second public signing key of the second user, and a first ephemeral public key to a first server;
receiving a response from the first server, wherein the response includes the first public signing key, the second public signing key, and the first ephemeral public key;
generating a second ephemeral asymmetric key pair;
generating a first communication encryption key;
encrypting a first communication using the first communication encryption key; and
transmitting the first encrypted communication to a second device of the second user, wherein the first encrypted communication includes the second ephemeral public key.
10. The non-transitory computer-readable medium of claim 9 , further comprising instructions for:
encrypting the first communication encryption key using a key-encrypting key derived, in part, from the first ephemeral public key and the second ephemeral private key.
11. The non-transitory computer-readable medium of claim 10 , further comprising instructions for:
transmitting the encrypted first encryption key with the first encrypted communication.
12. The non-transitory computer-readable medium of claim 9 , wherein the first communication is encrypted with the first encryption key according to a symmetric encryption algorithm.