TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The Messaging Layer Security (MLS) Protocol

159 点作者 pieter_mj将近 2 年前

12 条评论

walterbell将近 2 年前
<a href="https:&#x2F;&#x2F;www.ietf.org&#x2F;blog&#x2F;support-for-mls-2023&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.ietf.org&#x2F;blog&#x2F;support-for-mls-2023&#x2F;</a><p><pre><code> [AWS] Since the early days of MLS, AWS has been a core contributor by sharing our cryptographic expertise and engineering experience. [Cisco] supported the Messaging Layer Security (MLS) effort since its inception — including by using a draft version of MLS for Webex Zero Trust meetings — and are delighted to welcome the publication of the MLS protocol standard. [Cloudflare] With MLS, we see a future where large-scale, dynamic group communication can be private, secure, and efficient. We are eager to support and adopt this promising new standard. [Google&#x2F;Android] With seven years of development, MLS is mature and rigorously validated, making it the ideal choice to provide the security foundations of interoperable messaging.&quot; [Matrix] With other interested parties, we’re continuing to develop decentralized best practices for MLS (so-called Decentralized MLS) that will work without modification in a decentralized environment such as Matrix or IETF’s MIMI [Meta] conducted early research into Ratchet Trees alongside collaborators from Oxford University. [Mozilla] Although end-to-end encryption is at the heart of this initiative, interoperability, scalability, and performance were significant goals met along the way. Mozilla is proud to support this new standard. [Wire] Previously, technologies like Voice-over-IP and WebRTC played a significant role in democratizing global communication. Now, with MLS, we are building upon this success to again impact billions of people and achieve secure communication at an unprecedented scale.</code></pre>
评论 #36869711 未加载
评论 #36868882 未加载
评论 #36867986 未加载
giaour将近 2 年前
Security, Cryptography, Whatever did a good general overview of the spec a couple of months ago: <a href="https:&#x2F;&#x2F;securitycryptographywhatever.com&#x2F;2023&#x2F;04&#x2F;22&#x2F;mls&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;securitycryptographywhatever.com&#x2F;2023&#x2F;04&#x2F;22&#x2F;mls&#x2F;</a>
评论 #36890756 未加载
评论 #36869624 未加载
ementally将近 2 年前
From <a href="https:&#x2F;&#x2F;simplex.chat&#x2F;blog&#x2F;20230722-simplex-chat-v5-2-message-delivery-receipts.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;simplex.chat&#x2F;blog&#x2F;20230722-simplex-chat-v5-2-message...</a><p>&gt;Why not hosted groups with MLS?<p>&gt;Initially, we considered the design with the dedicated servers, potentially self-hosted, that host groups. This design would require adopting MLS (or similar) protocol for group-wide key agreement. Unfortunately, this design is not sufficiently resilient and easier to censor than decentralized design. Also, MLS protocol is very complex to implement, requires a centralized component, and reduces forward secrecy. So we decided against this approach.
评论 #36872945 未加载
derhuerst将近 2 年前
This has been discussed recently [1] in another post.<p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36815705">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36815705</a> (4 days ago, 202 points, 32 comments)
评论 #36865367 未加载
fabrice_d将近 2 年前
There&#x27;s an open source implementation at <a href="https:&#x2F;&#x2F;openmls.tech&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;openmls.tech&#x2F;</a>
评论 #36867778 未加载
dhx将近 2 年前
Another win for djb for a fully rigid curve[1] required for the single mandatory cipher suite MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519<p>[1] <a href="https:&#x2F;&#x2F;safecurves.cr.yp.to&#x2F;rigid.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;safecurves.cr.yp.to&#x2F;rigid.html</a>
评论 #36871362 未加载
hwbehrens将近 2 年前
I like the idea conceptually, but what is the likelihood of broader adoption? I notice that Meta, Apple, and Google are conspicuously absent from the contributors. Historically (see e.g. Matter) it seems like standards that aren&#x27;t written to conform to existing de facto implementations tend to be superseded by later ones that are.<p>I&#x27;ll admit to not having read the entirety of the RFC, but I&#x27;d also be curious about how the proposed approach maps to the current privacy&#x2F;UX goals that the established players are pursuing, e.g. if WhatsApp wants to preserve cleartext moderation of E2E group chats, is that possible under this scheme, etc.
评论 #36865361 未加载
评论 #36865257 未加载
评论 #36865615 未加载
评论 #36872340 未加载
评论 #36869697 未加载
say_it_as_it_is将近 2 年前
What is Moxie Marlinspike&#x27;s take on this? I don&#x27;t trust that an IETF task force is going to have the will to oppose government pressure for backdoors.
评论 #36867107 未加载
austin-cheney将近 2 年前
This past weekend I was trying to solve a similar problem also with shared public keys. I was having trouble getting it to work for my needs the way I wanted, so instead I am testing an approach of using large hash comparison based upon a preshared key. It’s a much higher grade of cryptographic reliability at a tiny fraction of the computational cost with many fewer parts to maintain.
txtsd将近 2 年前
Does this mean governments won&#x27;t be able to make messaging services yield? Or will they mangle it anyway like they do TLS to block websites?
评论 #36870925 未加载
pkulak将近 2 年前
Encrypted messages in large groups is such a hard problem, and, not to be crass, but is it worth solving? If I have 287 people on a group chat, how is that private, no matter the security? It seems like any adversary should be able to insert themselves into a situation like that unnoticed.
评论 #36866584 未加载
anonymousiam将近 2 年前
Why are they using MLS to describe this? That acronym has already been widely used.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Multilevel_security" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Multilevel_security</a><p><a href="https:&#x2F;&#x2F;csrc.nist.gov&#x2F;glossary&#x2F;term&#x2F;multi_level_security" rel="nofollow noreferrer">https:&#x2F;&#x2F;csrc.nist.gov&#x2F;glossary&#x2F;term&#x2F;multi_level_security</a><p><a href="https:&#x2F;&#x2F;gdmissionsystems.com&#x2F;multilevel-security" rel="nofollow noreferrer">https:&#x2F;&#x2F;gdmissionsystems.com&#x2F;multilevel-security</a><p><a href="https:&#x2F;&#x2F;access.redhat.com&#x2F;documentation&#x2F;en-us&#x2F;red_hat_enterprise_linux&#x2F;6&#x2F;html&#x2F;security-enhanced_linux&#x2F;mls" rel="nofollow noreferrer">https:&#x2F;&#x2F;access.redhat.com&#x2F;documentation&#x2F;en-us&#x2F;red_hat_enterp...</a><p><a href="https:&#x2F;&#x2F;www.ibm.com&#x2F;docs&#x2F;SSLTBW_2.3.0&#x2F;com.ibm.zos.v2r3.e0ze100&#x2F;ch1.htm" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.ibm.com&#x2F;docs&#x2F;SSLTBW_2.3.0&#x2F;com.ibm.zos.v2r3.e0ze1...</a>
评论 #36866032 未加载