When you stay around the support channels of Matrix, you’ll come across a lot of people asking why end-to-end-encryption (E2EE) is so complicated in Matrix or more explicit in Riot and why you have to verify each and every device of each and every member of a room. In order to get a properly trustable, encrypted room.

And since people often mention that “other messengers” are not that complicated, let’s have a look at what they do different than Matrix and how this allows certain assumptions about end-to-end-trust (E2ET).

Signal and TOFU

When you start a conversation on Signal, it’ll automatically be fully end-to-end-encrypted. This is achieved by key material being generated on your smartphone¹ and the parts, that are made to be published, are published to the Signal servers for other users to obtain.

When a user now initiates an conversation with you, the key material is obtained from the server to their device. The device uses this key material to generate the actual encryption keys, encrypt the message and send it to you.

All this is fully automated, there is no question to a user about that. But can you trust this?

Signal uses a concept called Trust-On-First-Use, short TOFU, for this step. It takes whatever key material is published on the server for your phone number and generates the encryption key based on that.

Every further requests will be verified against this existing “first use trust”.

Matrix and TOFU

When you login to Matrix using Riot, Riot will generate key material on your device (Smartphone, Desktop, …) and will upload this material to your Matrix homeserver, just like Signal does with the Signal servers.

When someone now initiates a conversation with you using an encrypted room, on the first message² they send to the room, they’ll generate a room key. In order to exchange this room key with you, their client will request their homeserver to fetch your Riot’s key material from your homeserver and generate an encryption key for the communication with your client.

So far, except of the additional homeserver and the room key part, this is pretty much like Signal does it.

But while Signal will go ahead now and send out the message, Riot will ask them, if they really want to send the message to “Untrusted devices”.

Signal and E2ET

In Signal you are not asked, because the Signal considers their own servers as semi-trustable. Which means, the likelihood that someone manipulates the key material there, is small, and it would break all existing sessions with your devices.

When you don’t want to rely on the semi-trustability of their servers, you can verify the clients using a QR-Code in the contacts menu.

“But why doesn’t this verification break with a new device, like Signal Desktop added?”, you might ask. The answer is because you delegate trust from and to a verification of each of your devices on setup, when you connect them using the QR code. This actually triggers a cross-signing of their key material and therefore authenticates these devices from your Smartphone¹.

Cross-signing is the act of signing the key material of the device A with a permanent key from device B. This allows delegation of trust from your phone A to your Desktop client B. Therefore from everyone who trusts A now also trusts B. This is of course limited to devices linked to A.

Matrix and E2ET

TOFU is not used in Riot, because it would be dangerous to do so. Right now, the architecture of Matrix allows password-based logins to your account and with this access you are allowed to generate key material and upload it.

Which mean given that someone makes it to obtain your password, they could compromise your device list and upload their own key material that TOFU would simply use to encrypt further messages and even share room keys of previous messages with this new device on request.

The password for your account is shipped around a lot. You have it stored it in your password safe, you send it on each sign-in to the server and everything between you and the server, that is able to break TLS³ is able to obtain it. Also your homeserver could just pretend that a client logged in and never reveal that to your other clients. This would allow a hidden listener to all your messages without you ever seeing it.

Therefore TOFU is completely unacceptable to use in this area. But what about trust delegation? When someone trusts you to take care of your own devices, then delegation shouldn’t be a problem.

Matrix and Cross-signing

And here is the good and bad news at the same time. Matrix should allow trust delegation soon. This is done by a process called cross signing, which pretty much works as with Signal. You do the regular verification process between device A and device B. Then whoever verified your device A will also trust device B. That’s the good news.

The bad news is: It’s not implemented in Riot yet. The server-side groundwork was done in Synapse 1.5.0 but in Riot the support is still missing. There are first proofs of concept for working cross-signing, but it’s not yet implemented in Riot.

According to some developers in the the E2E-cryptography room, with Cross-signing Riot will enable TOFU for encrypted rooms. This will make sure that the current warning screen disappears, that is shown when people enable encrypted rooms and the room contains an unverified devices. The future behaviour will simply not send the room key there at all.

Conclusion

Matrix E2EE and E2ET is different from most other messenger because the concept on how devices join and leave your account is different. Therefore TOFU is currently not a real option. The good news is that Cross-signing is a thing and will soon allow better communication, the bad news is that it’s not rolled-out yet.

Give it some more time, and I hope this clarifies the reasoning behind those problems a bit better.

Photo by Antônia Felipe on Unsplash