Encryption on Mobile Devices - Multiparty Encryption - Key Management

Question

I have the following setting: Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some time, and passes is on to the different C.

Now I am looking for an encryption scheme, such that A encrypts the message, and only the different C can decrypt it.

My first idea was to simply use the public keys of the different C. However, since B stores the encrypted messages for some time, and we have many copies of the message encrypted with the different private keys, this would not be efficient in terms of storage.

My next idea was to use a common key for the A and C, so that the message is encrypted with this secret key, and then passed on to B that does not posses this key. However, in this case I have the problem of how to generate a secret key between all these participants, that only communicate via B, and how to I handle the situation when a new A or C joins in.

Another idea is to use commutative encryption. However in this case the A and C will depend on the trustworthiness of B. Let A encrypt the message with the key of B, then B stores it encrypted. Then it encrypts it with the public keys of the C and decrypts with its own secret key. B never actually saw the message, would however been able to do so.

What will be the easiest scheme, so that we can easily update all key material, can easily have devices join in and store only one encrypted version of the secret messages without B being able to read it? Is there any efficient multi-party-encryption scheme with an easy handling of the key-material?

I was already referred to the Signal scheme. I am however lost in the scheme amount of algorithms they use. And I think the key-update process in my setting would be more complex, since all communication must pass by B.

If anyone understands my confusing explanation and has some idea of how I can solve this, any help or hint would be very much appreciated!

All the best,

Luca

Answer 1

You can use the same way as WhatsApp group messaging does.

Heavily oversimplifying it, this is what you can do:

1. Each member generates their own symmetric key called Sender key.

2. Every member shares their sender key with each other through one-to-one encryption scheme. In your case, you can share this key by encrypting it with their public keys. So if there are n members, each member sends their sender key n-1 times encrypted with individual's public key. Total number of key exchange will be n(n-1).

Participants' public key can be obtained from B acting as key distribution server.

3. If A wants to send a message to other members, A encrypts his message with his own sender key and sends it to B.

4. B creates copies of A's message equal to the number of recepients and forwards this it to them. This is called server side-fanout.

5. As recepient's already knows A's sender key, they can decrypt A's message.

6. When someone joins, he generates his own sender key and shares it with others the same way. Other members also share their keys with him like before. Total number of key exchange will be 2(n-1) for n members including the new one.

7. If someone leaves, every member clears their old sender key, generates a new one and shares their key again. Total number of key exchange will be n(n-1) for n existing members in the group.

8. To prevent a malicious member impersonating as some other member, each member signs their message using their private key. The public component to verify the signature can be obtained from B.

How you implement one to one messaging, this can be used to share sender keys to initialise multiparty encryption. You can also use Diffie-Hellman to share sender keys but it also has to be done n-1 times if there are n members.

Here's a good article on reducing the distribution of keys for multiparty encryption: Better Encrypted Group Chat