I was thinking about building a simple end-to-end encrypted chat with group chat capabilities. Please bare in mind that 1) it's just an experiment to help me know more about cryptography and 2) I'm an humble programmer not a security expert that knows all the cyphers out there and complex encryption schemes.
My first thought was to:
- Single conversations (two persons): each client generates a public/private key pair and sends the public key to the server. Every-time someone whats to talk to another person they just have to grab the recipient's public key from the server and encrypt the messages using that key. Later on the recipient can just decrypt them with their private key;
- Group Chats: when someone starts a group chat:
- A public/private key pair is generated by the user who created the chat (lets call it starter);
- The "starter" fetches all public keys of the participants from the server and encrypts the chat's private key with them;
- The "starter" sends the encrypted chat private key to each participant;
- Each participant can now send encrypted messages (by encrypting them with the chat's public key) and decrypt messages coming from others by using the chat's public key.
- If someone is added or removed from the chat, a new chat public/private key pair is generated and distributed using the same procedure above.
Focusing on the group chats: What are the drawbacks of this implementation? Is this a reasonable and secure approach to the problem?