End-to-end "group chat" encryption

Question

I have a case here, where I need to encrypt messages to a team/group. Everyone in the group can create a new message, and everyone else in the group can read/edit/delete that message. I want the following things:

1. Encrypted messages
2. Decryptable by everyone in a group (no one else can unlock it)
3. Group members can read/edit each message
4. No re-use of messages (like storing all the team members' public keys and then encrypt all messages with their public key), as that wouldn't work in this case
5. Possible to add a new member to the group and give that member access to all previous messages

The main property of this is security. I do not want anyone to be able to access the messages.

Here's a possible problem: If the whole database gets dropped and someone already has an account on that site, that said user should NOT be able to just add himself to that group, to display all the passwords stored in that group (like if the person recreates the application using the database). The messages would need to be encrypted somehow, that no one (not even with the database in hand) can access the encrypted messages.

What am I looking at doing here? It's a pretty unique case I think.

Answer 1

Let's start with your last constraint: if the database is compromised, then attacker must not be able to extract a key from the database and decrypt messages. A simple way to ensure this is make sure the key is not in the database. That is, whatever keys/etc. are required to decrypt the messages are stored by each client, not centrally.

You said you don't want to encrypt each message for each person using their public key. Is a per-person symmetric key also out? The disadvantage there is that in an N-person group each message would have N signatures, and there would need to be N² keys - so this is not ideal for large groups.

Instead, what if there was a single "group key", which everybody uses to encrypt their messages? Everybody in this group would have this key. Part of "joining" a group is where an existing member shares their copy of the key with you. To prove authorship (if that's desired) you could sign each message with the public key of the author - edited messages would be signed with the public key of the editor.

If there's a single group key, you would need to rotate this key whenever someone got booted out from the group. This would require a user commonly-accepted as a "group administrator" sending a message to each individual member telling them the new key. In order for new members to be able to read the entire history, it could make sense for the old key to be encrypted with the new key and posted to the group (possibly as part of the "X has left the group" notification), so that new members can follow the message history back across this boundary.

So: a single group key stored in the clients not the servers, keys replaced whenever a member leaves the group and sent to each member (public-key encryted) by an admin, and each message/edit optionally signed by public key (different from the previous one, because you never sign and encrypt with the same key). This seems to me like it would fit your requirements, but it falls short on some other requirements - the gold standard is Whisper Systems, so you could read about how they do things.

Answer 2

Haven't used it in a while, but Threema is a good end-to-end encryption tool that can do group chats. Can't speak to the rest.

https://threema.ch/en/faq/groupchat