Methods, mediums, and systems for verifying devices in an encrypted messaging system
This application describes methods, mediums, and systems for verifying a device for use in a messaging system. Using the device verification procedures described, a messaging system can securely authorize new devices to send and receive encrypted messages on behalf of a user, preferably without the need to share a private encryption key between the users' different devices. The application describes several techniques that can be used to provide such a system, including distributing a computer-perceptible code that encodes encryption information between a secondary device and a primary device. This allows the information to be distributed without intervention by a server. Other techniques provide unique ways to build and reverify authorized device lists, distribute encryption keys in chat channels, ensure that lists of authorized devices are distributed in the correct order and remain valid for an appropriate amount of time, add new devices to an ongoing or new conversation, and more.
1. A method comprising:
receiving, from a server in an encrypted messaging system, a list of devices authorized to participate in an encrypted conversation, wherein the list of devices comprises a primary device and a secondary device associated with a user, and the primary and secondary devices have different cryptographic keys;
verifying that the device list was signed by the primary device; and
sending a message to the user based on the device list using a first cryptographic key associated with the primary device and a second cryptographic key associated with the secondary device to encrypt the message, wherein the first and second cryptographic keys are received separately from the list of devices.
2. The method of claim 1 , wherein the first and second cryptographic keys are received after the list of devices.
3. The method of claim 1 , further comprising verifying that the first and second cryptographic keys were signed by the primary device.
4. The method of claim 3 , wherein verifying the first and second cryptographic keys are performed after verifying that the device list was signed.
5. The method of claim 1 , wherein the first and second cryptographic keys have a size that is larger than a size of the list of devices.
6. A non-transitory computer-readable medium storing instructions configured to cause a processor to:
receive, from a server in an encrypted messaging system, a list of devices authorized to participate in an encrypted conversation, wherein the list of devices comprises a primary device and a secondary device associated with a user, and the primary and secondary devices have different cryptographic keys;
verify that the device list was signed by the primary device; and
send a message to the user based on the device list using a first cryptographic key associated with the primary device and a second cryptographic key associated with the secondary device to encrypt the message, wherein the first and second cryptographic keys are received separately from the list of devices.
7. The medium of claim 6 , wherein the first and second cryptographic keys are received after the list of devices.
8. The medium of claim 6 , further storing instructions configured to cause the processor to verify that the first and second cryptographic keys were signed by the primary device.
9. The medium of claim 8 , wherein verifying the first and second cryptographic keys are performed after verifying that the device list was signed.
10. The medium of claim 6 , wherein the first and second cryptographic keys have a size that is larger than a size of the list of devices.
11. An apparatus comprising:
a processor; and
a non-transitory computer-readable medium storing instructions configured to cause a processor to:
receive, from a server in an encrypted messaging system, a list of devices authorized to participate in an encrypted conversation, wherein the list of devices comprises a primary device and a secondary device associated with a user, and the primary and secondary devices have different cryptographic keys;
verify that the device list was signed by the primary device; and
send a message to the user based on the device list using a first cryptographic key associated with the primary device and a second cryptographic key associated with the secondary device to encrypt the message, wherein the first and second cryptographic keys are received separately from the list of devices.
12. The apparatus of claim 11 , wherein the first and second cryptographic keys are received after the list of devices.
13. The apparatus of claim 11 , the non-transitory computer-readable medium further storing instructions configured to cause the processor to verify that the first and second cryptographic keys were signed by the primary device.
14. The apparatus of claim 11 , wherein the first and second cryptographic keys have a size that is larger than a size of the list of devices.