Published: July 17, 2024

We're thrilled to announce that XMTP now supports group chat! This highly requested feature has been a while in the making, and we're excited to finally bring it to you. The team has worked tirelessly to ensure that group chats come with robust security guarantees, built with MLS, making conversations more secure than ever. We couldn’t have achieved this milestone without the dedication of the core team and the continuous support and feedback of the amazing XMTP developer community. Dive into this post by XMTP's core cryptographer, Daniel Zhou, to learn about the features that make XMTP’s group chat experience uniquely secure and private.

— Naomi Plasterer, Senior Staff Software Engineer for XMTP

How XMTP x MLS delivers uniquely secure group chat

At its foundation, XMTP (Extensible Message Transport Protocol) is designed to ensure secure and private communication. Of course, designing and building group chat was no different. We leveraged the following resources to deliver uniquely secure group chat:

• Advanced cryptographic techniques
• Secure key management practices
• MLS (Messaging Layer Security)

Specifically, XMTP group chat inherits the comprehensive security properties of the MLS standard listed below:

• Message confidentiality

  Ensures that the contents of messages in transit cannot be read without the corresponding encryption keys.

• Forward secrecy

  Ensures that past messages remain secure even if current encryption keys are compromised.

• Post-compromise security

  Ensures that future messages remain secure even if current encryption keys are compromised.

• Message authentication

  Validates the identity of the participants in the conversation, preventing impersonation.

• Message integrity

  Ensures that messages cannot be tampered with during transit.

• Group state and operation protection

  Protects the group state cryptographically and hides group operations from the server or infrastructure.

In addition to the security properties provided by MLS, XMTP also adds:

• User anonymity

  Ensures that outsiders cannot deduce the participants of a group, users who have interacted with each other, or the sender or recipient of individual messages.

A deep dive into group chat security properties

Message confidentiality

Message confidentiality is achieved through symmetric encryption, ensuring that only intended recipients can read the message content. AEAD (Authenticated Encryption with Associated Data) **is used to encrypt the message content, providing robust protection against unauthorized access.