Group Chat — Sender Keys

Naive group encryption: encrypt each message N times, once per recipient. O(N) work per message. Fine for 5-person chat; brutal for 1000-person group.

Signal's solution: Sender Keys.

Each member has a chain key for their messages, plus a signing key (Ed25519) tying them to the message.

Per group, each sender has:
- chain_key: 32-byte symmetric chain key
- signing_key: Ed25519 keypair

Sending:

The ciphertext is broadcast once. Each receiver decrypts with their own copy of sender_state.

Distribution: the first time a sender messages a group, they 1:1-encrypt their (chain_key, signing_pub) to each member via Double Ratchet. Subsequent messages: just broadcast.

Pros:

• O(1) work per message after key distribution.
• Forward secrecy via chain advancement.

Cons:

• Removing a member: chain key must be rotated (new chain key, redistribute). All current chain knowledge held by the leaver remains valid for past messages but they can't read new ones.
• Lost member must re-run distribution (their chain forks).

WhatsApp uses this. Modern variant for very large groups: MLS (Messaging Layer Security, RFC 9420) — uses a tree of keys for log(N) updates instead of O(N).

Sender keys are weaker: a leaker can dump the chain. MLS provides post-compromise security via tree updates.