True identity key rotation seems somewhat important in the long term

[link2xt]

@ell1e

I’m pretty sure Matrix allows changing the user key which breaks e2ee, but afaik keeps connections, room ownership, permissions, etc.

This only shows that in Matrix group metadata, membership and permissions is not E2E protected. It is instead protected with homeserver keys. IIRC even the group description is not protected for encrypted groups.

In Signal there is something in-between: if you resetup but use Secure Value Recovery (enter a PIN), you get the same account ID (similar to the same email address) and restore your group membership and verifications, but your identity key is changed. Group membership is managed on the server, but in a way that the server cannot see account IDs stored there: Signal >> Blog >> Technology Preview: Signal Private Group System, The Signal Private Group System and Anonymous Credentials Supporting Efficient Verifiable Encryption
What happens if the identity key is actually compromised and available to the attacker is hard to tell, Signal >> Specifications >> The Sesame Algorithm: Session Management for Asynchronous Message Encryption just says “Security is catastrophically compromised if an attacker learns a device’s secret values, such as the identity private key and session state.”

There are Continuous Group Key Agreement protocols in development that can have “post-compromise security” and “clone detection”, but no messenger has deployed it yet AFAIK and the protocols that are being deployed now are not decentralized:

Messaging Layer Security Protocol Standard?

Wire wants to deploy MLS end of April: Would be interesting to see how it goes. Could be the first Secure Messenger to have Continuous Group Key Agreement deployed.

In Delta Chat group membership is managed entirely on devices without any servers, so there is no place where you can recover your group membership from.

@ell1e

If delta chat ties rights to identity key rather than e-mail, but has no such reset or rotation, the user seems to be screwed in this situation.

If user lost the identity key, the only way to recover from this cryptographically is to tell as many peers as possible that the key is revoked so it is removed from all chats and no messages are sent to encryption keys signed by this identity. Then you need to create a new identity and join the chats with it.

There is a draft for OpenPGP key replacement at draft-ietf-openpgp-replacementkey-03 - OpenPGP Key Replacement but in case of key compromise it cannot work automatically because the key in this case is “hard-revoked”.

For non-cryptographic means see:

Remote wipe from a lost device

Delta Chat already Disappearing Messages feature and settings to configure deletion of messages from the device and from the server after selected time period. These features however do not help if device is lost or stolen because messages are not deleted immediately. For this case there should be a way to remotely wipe a profile from the device. One way to implement it would be to generate a device code that will wipe the profile when received. This solution is independent of the server. Ther…