Podcast
Root Causes 329: What Is Messaging Layer Security?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
August 29, 2023
The recently published Messaging Layer Security (MLS) protocol establishes key exchange protocols for participants in a simultaneous communication session for three or more participants. We explain its significance and possible futures for this standard.
Podcast Transcript
Lightly edited for flow and brevity.
There have been messaging protocols for a while now and some of them are proprietary, and they belong to the big tech companies. I use Apple's iMessage fairly often and that's an example of this. But let's go all the way back. I think that you could, back in the day, have used something like PGP, Tim? Which is something that maybe one of these days, we will do a podcast. The reason Tim's laughing is because we've been planning that one for quite a while.
Which really, really started to make things easy and secure. Offline communications was something that was different, but I think one of the things that really was big about it was the fact that there was a lot of uptake on it. I remember when WhatsApp first talked about implementing Signal at its underneath it, I was like, wow, geez, that's kind of a big deal. And there are others as well who have moved off of their own either proprietary protocols or older protocols and moved to Signal.
But you know what none of them did great, Tim, and in fact, even Apple iMessage wasn't great for this until not long ago, and it was a tough problem to solve, was things such as group communications.
And so I think what's different here is group communications, the fact that there's the implementation is in a full blown RFC. It's not just something that was created and it is, you know, I haven't delved into this. I have to admit mea culpa to anybody listening who might see this as a mistake. I'll say something that I haven't double and triple checked. But, the open source licensing for this is going to be great so that people can really start to adopt this implementation that's being standardized here. But, we talked about Rust in previous podcasts, and we talked about how Rust is great, in the sense that it helps - - the whole purpose - - well, one of the purposes of using it is that bugs that are introduced by coding practices and other low level languages can sometimes lead to things like buffer overflows and bugs that are found later on. Imagine if this thing takes off, Tim, and it gets implemented by all these different people who knows, maybe all of us around the world might be using MLS to chat with each other in a secure way. Imagine if there was some bug and oh my goodness. That would be an oh my goodness moment. Well, there apparently, and this is what I haven't triple checked, reference implementation within Rust is kind of an interesting development here.
The number of members in a group exponentially creates work that has to be done in terms of encryption. And what MLS is able to do here is instead of being exponential, this is a logarithmic relationship of complexity as you add members to the group and so therefore, as it says, in the article, I'll read it right off, it makes it very well suited, even for large groups. And so, obviously, there's just a ton of work that has been done inside of here. We can get into maybe in a future podcast, we'll get right into the mechanism. But I think there's some real clever work that has gone on into this implementation.
And Tim, I think one point that needs to be made here, of course, you always got to talk about the 800-pound gorillas, but I do believe, I do believe, that Google messages will be implementing MLS, which is going to be a huge shot in the arm for it.
There's a whole lot of preamble which touts MLS, and it ends with: “This is why we intend to build MLS into Google messages and support its wide deployment across the industry by open sourcing our implementation in the Android codebase.” Guess what? That means the MLS is gonna become a big deal.
So, all right. Well, that's good. I think that's an interesting development and exciting to hear about and it sounds like it's generally going to be a step up in security and performance for messaging across the ecosystem.

