Inside MLS, the New Protocol for Secure Enterprise Messaging

As personal messaging platforms see the rise of end-to-end encryption, businesses struggle to provide strong levels of security.

As the world moves toward end-to-end encryption for personal messaging platforms, businesses are challenged to integrate the same level of security in corporate messaging apps.
Even encryption protocols for person-to-person messaging are still undergoing development. Services want to reduce the amount of sensitive data they store; however, only a few encryption protocols – Signal, for one – have been scrutinized for security.
The Signal
protocol
, which rolled out to WhatsApps base of one billion users in 2016, is the first end-to-end encryption protocol to be globally deployed. Security guarantees of the open-source protocol include forward-secrecy and recovery from key compromise. And while a few personal messaging systems have adopted Signal, corporate messaging has failed to follow.
In the consumer space there are a few services with end-to-end encryption but in the business space its very rare, says Raphael Robert, head of security at Wire, which launched in 2014 as a secure messenger primarily built for consumers. Since then, it has repositioned itself to build a secure business collaboration system. Wire is currently in the midst of working to develop Messaging Layer Security (MLS), a new protocol designed to facilitate more secure enterprise messaging platforms.
Technical challenges often hold companies back from adopting end-to-end encryption. The bigger the organization, the harder it is to make a change in general, says Robert. Scalability is a key problem: WhatsApp, for example, uses a protocol dubbed Sender-Keys to support group chats. The problem is, the protocol doesnt support post-compromise-security, meaning in a simple deployment an employee who left the company may still read messages.
In many modern enterprise environments, products use transport encryption between client and server but messages and content being shared arent encrypted on the server. This information usually ends up in a large database, he continues, where its vulnerable to third-party access. A cybercriminal needs only an employees credentials to break in and get it.
This is a huge risk, which doesnt really meet the requirements of businesses in general, he adds. There is typically very sensitive information.
Messaging Layer Security (MLS): A New Protective Protocol
To address the many issues in enterprise messaging security, the Internet Engineering Task Force (IETF) is building the MLS group messaging protocol. Its goals for MLS differ from those of pairwise protocols: it aims to allow practical groups up to 50,000 clients, cover multiple industry use cases including federation and Web browser support, and offer formal security guarantees.
When Wire introduced end-to-end encryption to its system in 2016 and open-sourced its code base, secure messaging protocols were always a big issue, says Robert. There was no open standard they could adopt. That summer, during the IETF meeting in Berlin, Wire proposed a standard that was protected by modern security properties and could be used by companies large and small.
MLS has since been undergoing development. While initiated by Wire, along with Mozilla and Cisco, in 2016, it has received support from major tech companies along the way: Facebook, Google, INRIA, and Twitter have all contributed to the effort. In the past 18 months weve worked a lot on the core protocol to make sure of what kind of security guarantees we want to achieve and how we can achieve them, says Robert. Now, theyre finalizing it for the academic community to review.
How will it be different? Researchers proposed it should be possible to use MLS in a federated environment, meaning you dont need a central server or central cloud to implement it. Employees should be able to communicate across clouds and devices, Robert explains.
Many businesses also struggle with the risk of shadow IT, he continues. People rely on their mobile apps to communicate internally and externally, and its difficult to regulate. Most employees use multiple devices, which most existing protocols never really took into account, he adds. Since its inception, the people behind MLS wanted to address security across devices.
One of the core goals of MLS was to support multi-device scenarios and support groups, particularly large groups, and to make encryption as efficient as possible, he adds. With many protocols, encryption for groups can get expensive.
By next year, he hopes, MLS will be ready to integrate into messaging platforms. Robert, along with INRIAs Benjamin Beurdouche and independent researcher Katriel Cohn Gordon, will discuss the research behind, and details of, MLS this summer at Black Hat USA in a briefing entitled
Messaging Layer Security: Towards a New Layer of Secure Group Messaging
.
Related Content:
7 Container Components That Increase a Networks Security
How Hackers Infiltrate Open Source Projects
Developers and Security Teams Under Pressure to Collaborate
Email Threats Continue to Grow as Attackers Evolve, Innovate

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Inside MLS, the New Protocol for Secure Enterprise Messaging