@article{chowdhury2023threat, title={Threat Models over Space and Time: A Case Study of E2EE Messaging Applications}, author={Chowdhury, Partha Das and Sameen, Maria and Blessing, Jenny and Boucher, Nicholas and Gardiner, Joseph and Burrows, Tom and Anderson, Ross and Rashid, Awais}, journal={arXiv preprint arXiv:2301.05653}, year={2023} } @inproceedings{albrecht2022practically, title={Practically-exploitable Cryptographic Vulnerabilities in Matrix}, author={Albrecht, Martin R and Celi, Sof{\'\i}a and Dowling, Benjamin and Jones, Daniel}, booktitle={2023 IEEE Symposium on Security and Privacy (SP)}, pages={1419--1436}, year={2022}, organization={IEEE Computer Society} } @phdthesis{van2022x, title={The X3DH Protocol: A Proof of Security}, author={Ferran van der Have}, year={2022}, school={Raboud Uni} } @misc{cryptoeprint:2011/615, author = {Jean Paul Degabriele and Anja Lehmann and Kenneth G. Paterson and Nigel P. Smart and Mario Strefler}, title = {On the Joint Security of Encryption and Signature in EMV}, howpublished = {Cryptology ePrint Archive, Paper 2011/615}, year = {2011}, note = {\url{https://eprint.iacr.org/2011/615}}, url = {https://eprint.iacr.org/2011/615} } @misc{cryptoeprint:2011/300, author = {Cas Cremers and Michele Feltz}, title = {One-round Strongly Secure Key Exchange with Perfect Forward Secrecy and Deniability}, howpublished = {Cryptology ePrint Archive, Paper 2011/300}, year = {2011}, note = {\url{https://eprint.iacr.org/2011/300}}, url = {https://eprint.iacr.org/2011/300} } @techreport{Marlinspike2016DoubleRatchet, title={The Double Ratchet Algorithm}, type={Tech Report}, editor="Trevor Perrin", author="Moxie Marlinspike", date="2016-11-20", } @inproceedings{borisov2004off, title={Off-the-record communication, or, why not to use PGP}, author={Borisov, Nikita and Goldberg, Ian and Brewer, Eric}, booktitle={Proceedings of the 2004 ACM workshop on Privacy in the electronic society}, pages={77--84}, year={2004} } @inproceedings{di2005secure, title={Secure off-the-record messaging}, author={Di Raimondo, Mario and Gennaro, Rosario and Krawczyk, Hugo}, booktitle={Proceedings of the 2005 ACM Workshop on Privacy in the Electronic Society}, pages={81--89}, year={2005} } @inproceedings{alexander2007improved, title={Improved user authentication in off-the-record messaging}, author={Alexander, Chris and Goldberg, Ian}, booktitle={Proceedings of the 2007 ACM workshop on Privacy in electronic society}, pages={41--47}, year={2007} } @article{moscaritolo2012silent, title={Silent circle instant messaging protocol protocol specification}, author={Moscaritolo, Vinnie and Belvin, Gary and Zimmermann, Phil}, journal={Online, White Paper}, pages={47}, year={2012} } @techreport{TR021021, title={Kryptographische Verfahren}, subtitle={Empfehlungen und Schl{\"u}ssell{\"a}ngen}, type={Technische Richtlinie}, number={TR-02102-1 2022-01}, publisher={Bundesamt f{\"u}r Sicherheit in der Informationstechnik}, address={Bonn}, year={2022} } @techreport{TR021022, title={Kryptographische Verfahren}, subtitle={Verwendung von Transport Layer Security (TLS)}, type={Technische Richtlinie des BSI}, number={TR-02102-2 2022/01}, publisher={Bundesamt f{\"u}r Sicherheit in der Informationstechnik}, address={Bonn}, year={2022}, } @inproceedings{Alwen2018TheDR, title={The Double Ratchet: Security Notions, Proofs, and Modularization for the Signal Protocol}, author={Jo{\"e}l Alwen and Sandro Coretti and Yevgeniy Dodis}, booktitle={IACR Cryptol. ePrint Arch.}, year={2018}, url="https://cs.nyu.edu/~dodis/ps/signal.pdf", file="AlwenDoubleRatchet.pdf", } @article{CohnGordon2017AFS, title={A Formal Security Analysis of the Signal Messaging Protocol}, author={Katriel Cohn-Gordon and Cas J. F. Cremers and Benjamin Dowling and Luke Garratt and Douglas Stebila}, journal={2017 IEEE European Symposium on Security and Privacy (EuroS\&P)}, year={2017}, pages={451-466}, url="https://eprint.iacr.org/2016/1013.pdf", file="SignalFormalAnalysis.pdf", } @inproceedings{Alwen2019DoubleRatchet, title={The double ratchet: security notions, proofs, and modularization for the signal protocol}, author={Alwen, Jo{\"e}l and Coretti, Sandro and Dodis, Yevgeniy}, booktitle={Annual International Conference on the Theory and Applications of Cryptographic Techniques}, pages={129--158}, year={2019}, organization={Springer}, url="https://eprint.iacr.org/2018/1037.pdf", file="", } @article{Jaeger2018Messaging, title={Optimal Channel Security Against Fine-Grained State Compromise: The Safety of Messaging. }, author={ Joseph Jaeger and Igors Stepanovs }, journal={ IACR Cryptology ePrint Archive }, year={ 2018 }, volume={ 2018 }, url="https://eprint.iacr.org/2018/553.pdf", file="JaegerMessagingSafety.pdf", } @article{vehkaoja2017end, title={End-to-end encryption protocol for internet of things devices}, author={Vehkaoja, Ville}, journal={University of Oulu, degree programme in computer science and engineering, Master’s Thesis}, volume={38}, url="http://jultika.oulu.fi/files/nbnfioulu-201706022469.pdf", file="", year={2017} } @article{Bienstock2022DoubleRatchetAnalysis, author = {Alexander Bienstock and Jaiden Fairoze and Sanjam Garg and Pratyay Mukherjee and Srinivasan Raghuraman}, title = {A More Complete Analysis of the Signal Double Ratchet Algorithm}, howpublished = {Cryptology ePrint Archive, Paper 2022/355}, year = {2022}, note = {\url{https://eprint.iacr.org/2022/355}}, url = {https://eprint.iacr.org/2022/355}, file="Bienstock2022DoubleRatchetAnalysis.pdf", } @misc{cryptoeprint:2024/357, author = {Douglas Stebila}, title = {Security analysis of the {iMessage} {PQ3} protocol}, howpublished = {Cryptology {ePrint} Archive, Paper 2024/357}, year = {2024}, url = {https://eprint.iacr.org/2024/357} } @misc{cryptoeprint:2022/1533, author = {Keitaro Hashimoto and Shuichi Katsumata and Thomas Prest}, title = {How to Hide {MetaData} in {MLS}-Like Secure Group Messaging: Simple, Modular, and Post-Quantum}, howpublished = {Cryptology {ePrint} Archive, Paper 2022/1533}, year = {2022}, doi = {10.1145/3548606.3560679}, url = {https://eprint.iacr.org/2022/1533} } @INPROCEEDINGS{7961995, author={Kobeissi, Nadim and Bhargavan, Karthikeyan and Blanchet, Bruno}, booktitle={2017 IEEE European Symposium on Security and Privacy (EuroS\&P)}, title={Automated Verification for Secure Messaging Protocols and Their Implementations: A Symbolic and Computational Approach}, year={2017}, pages={435-450}, keywords={Cryptography;Computational modeling;Analytical models;Cryptographic protocols;Computer bugs;formal verification;secure messaging;cryptographic protocols}, doi={10.1109/EuroSP.2017.38} } @online{hashimoto2025mls_pqc_auth, ids={cryptoeprint:2025/426}, author = {Hashimoto, Keitaro and Katsumata, Shuichi and Pascual-Perez, Guillermo}, title = {Exploring how to authenticate application messages in MLS: More efficient, post-quantum, and anonymous blocklistable}, date = {2025}, eprinttype = {iacr}, eprint = {2025/426}, institution = {IACR Cryptology ePrint Archive}, url = {https://eprint.iacr.org/2025/426}, urldate = {2026-04-18}, langid = {english}, abstract = {This work studies authentication mechanisms for MLS application messages and proposes more efficient constructions with post-quantum security. It further explores anonymity and blocklisting properties in group messaging settings.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,post-quantum signatures,authentication,secure messaging} } @misc{cryptoeprint:2019/1489, author = {Joël Alwen and Margarita Capretto and Miguel Cueto and Chethan Kamath and Karen Klein and Ilia Markov and Guillermo Pascual-Perez and Krzysztof Pietrzak and Michael Walter and Michelle Yeo}, title = {Keep the Dirt: Tainted {TreeKEM}, Adaptively and Actively Secure Continuous Group Key Agreement}, howpublished = {Cryptology {ePrint} Archive, Paper 2019/1489}, year = {2019}, url = {https://eprint.iacr.org/2019/1489} } @online{alwen2019mls_analysis, ids={cryptoeprint:2019/1189}, author = {Alwen, Jo{\"e}l and Coretti, Sandro and Dodis, Yevgeniy and Tselekounis, Yiannis}, title = {Security analysis and improvements for the IETF MLS standard for group messaging}, date = {2019}, eprinttype = {iacr}, eprint = {2019/1189}, institution = {IACR Cryptology ePrint Archive}, url = {https://eprint.iacr.org/2019/1189}, urldate = {2026-04-18}, langid = {english}, abstract = {The authors analyze the MLS protocol draft and identify potential weaknesses. They propose improvements and provide formal arguments for stronger post-compromise security in group messaging.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,post-compromise security,group key agreement} } @online{alwen2021mls_security, ids = {cryptoeprint:2021/1083}, author = {Alwen, Jo{\"e}l and Coretti, Sandro and Dodis, Yevgeniy and Tselekounis, Yiannis}, title = {Modular design of secure group messaging protocols and the security of MLS}, date = {2021}, eprinttype = {iacr}, eprint = {2021/1083}, institution = {IACR Cryptology ePrint Archive}, url = {https://eprint.iacr.org/2021/1083}, urldate = {2026-04-18}, langid = {english}, abstract = {The paper presents a modular framework for analyzing secure group messaging protocols and provides a formal security analysis of MLS. It identifies core building blocks such as TreeKEM and proves their security properties.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,group messaging,treekem,forward secrecy} } @inproceedings{Alwen2020continuous, ids={cryptoeprint:2020/752}, title={Continuous group key agreement with active security}, author={Alwen, Jo{\"e}l and Coretti, Sandro and Jost, Daniel and Mularczyk, Marta}, booktitle={Theory of Cryptography Conference}, pages={261--290}, year={2020}, organization={Springer}, url="https://eprint.iacr.org/2020/752.pdf", file="Alwen2020continuous.pdf", } @misc{cryptoeprint:2021/1456, author = {Joël Alwen and Dominik Hartmann and Eike Kiltz and Marta Mularczyk}, title = {Server-Aided Continuous Group Key Agreement}, howpublished = {Cryptology {ePrint} Archive, Paper 2021/1456}, year = {2021}, doi = {10.1145/3548606.3560632}, url = {https://eprint.iacr.org/2021/1456} } @misc{cryptoeprint:2020/1327, author = {Joël Alwen and Daniel Jost and Marta Mularczyk}, title = {On The Insider Security of {MLS}}, howpublished = {Cryptology {ePrint} Archive, Paper 2020/1327}, year = {2020}, url = {https://eprint.iacr.org/2020/1327} } @misc{cryptoeprint:2025/410, ids={wallez2025treekem}, title={TreeKEM: A Modular Machine-Checked Symbolic Security Analysis of Group Key Agreement in Messaging Layer Security}, author={Wallez, Th{\'e}ophile and Protzenko, Jonathan and Bhargavan, Karthikeyan}, booktitle={2025 IEEE Symposium on Security and Privacy (SP)}, pages={4375--4390}, howpublished = {Cryptology {ePrint} Archive, Paper 2025/410}, url = {https://eprint.iacr.org/2025/410}, year={2025}, organization={IEEE} } @online{wallez2023treesync, ids={cryptoeprint:2022/1732}, title = {{TreeSync}: Authenticated Group Management for Messaging Layer Security}, author={Wallez, Th{\'e}ophile and Protzenko, Jonathan and Beurdouche, Benjamin and Bhargavan, Karthikeyan}, booktitle={32nd USENIX Security Symposium (USENIX Security 23)}, howpublished = {Cryptology {ePrint} Archive, Paper 2022/1732}, url = {https://eprint.iacr.org/2022/1732}, pages={1217--1233}, year={2023} } @misc{cryptoeprint:2025/229, author = {Cas Cremers and Esra Günsay and Vera Wesselkamp and Mang Zhao}, title = {{ETK}: External-Operations {TreeKEM} and the Security of {MLS} in {RFC} 9420}, howpublished = {Cryptology {ePrint} Archive, Paper 2025/229}, year = {2025}, url = {https://eprint.iacr.org/2025/229} } @misc{cryptoeprint:2021/137, author = {Chris Brzuska and Eric Cornelissen and Konrad Kohbrok}, title = {Cryptographic Security of the {MLS} {RFC}, Draft 11}, howpublished = {Cryptology {ePrint} Archive, Paper 2021/137}, year = {2021}, url = {https://eprint.iacr.org/2021/137} } @misc{cryptoeprint:2017/666, author = {Katriel Cohn-Gordon and Cas Cremers and Luke Garratt and Jon Millican and Kevin Milner}, title = {On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees}, howpublished = {Cryptology {ePrint} Archive, Paper 2017/666}, year = {2017}, url = {https://eprint.iacr.org/2017/666} } @InProceedings{10.1007/978-3-319-08506-7_8, author="Miller, Brad and Huang, Ling and Joseph, A. D. and Tygar, J. D.", editor="De Cristofaro, Emiliano and Murdoch, Steven J.", title="I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis", booktitle="Privacy Enhancing Technologies", year="2014", publisher="Springer International Publishing", address="Cham", pages="143--163", abstract="Revelations of large scale electronic surveillance and data mining by governments and corporations have fueled increased adoption of HTTPS. We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 90{\%} accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. We examine evaluation methodology and reveal accuracy variations as large as 17{\%} caused by assumptions affecting caching and cookies. We present a novel defense reducing attack accuracy to 25{\%} with a 9{\%} traffic increase, and demonstrate significantly increased effectiveness of prior defenses in our evaluation context, inclusive of enabled caching, user-specific cookies and pages within the same website.", isbn="978-3-319-08506-7" } @InProceedings{10.1007/978-3-030-26948-7_9, author="Bellare, Mihir and Ng, Ruth and Tackmann, Bj{\"o}rn", editor="Boldyreva, Alexandra and Micciancio, Daniele", title="Nonces Are Noticed: AEAD Revisited", booktitle="Advances in Cryptology -- CRYPTO 2019", year="2019", publisher="Springer International Publishing", address="Cham", pages="235--265", abstract="We draw attention to a gap between theory and usage of nonce-based symmetric encryption, under which the way the former treats nonces can result in violation of privacy in the latter. We bridge the gap with a new treatment of nonce-based symmetric encryption that modifies the syntax (decryption no longer takes a nonce), upgrades the security goal (asking that not just messages, but also nonces, be hidden) and gives simple, efficient schemes conforming to the new definitions. We investigate both basic security (holding when nonces are not reused) and advanced security (misuse resistance, providing best-possible guarantees when nonces are reused).", isbn="978-3-030-26948-7" } @article{husak2016https, title={HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting}, author={Hus{\'a}k, Martin and {\v{C}}erm{\'a}k, Milan and Jirs{\'\i}k, Tom{\'a}{\v{s}} and {\v{C}}eleda, Pavel}, journal={EURASIP Journal on Information Security}, volume={2016}, number={1}, pages={6}, year={2016}, publisher={Springer} } @phdthesis{amslaurea18467, title = {Analysis and Implementation of the Messaging Layer Security Protocol}, author = {Giancecchi, Nicola}, abstract = {The use of messaging services on smartphones has increased considerably in recent years, due to the growth in the availability of mobile devices and the evolution of communication technologies via Internet, factors that have effectively replaced the use of text messages. This increase also concerned the use in the business environment, a context where the exchange of confidential information is more frequent and therefore the need to protect communication between two or more people. This is important not only on a security point of view, but also for personal privacy. The major global players have responded by implementing security measures within their services, such as end-to-end encryption and increasingly strict rules regarding the processing of personal data. In this thesis we will illustrate Messaging Layer Security, shortened as MLS, a new protocol under development that guarantees security and efficiency in group conversations. When in a conversation between two clients, security can be ensured through end-to-end encryption and key exchange. The problem arises when multiple actors participate in the conversation asynchronously: in this case the computational effort is considerable, even more so considering the use of mobile devices with reduced battery capacity that does not guarantee the continuous presence of the online device. The thesis will deal with both the architectural part, that is more general and traces the outline of the subject, and the protocol part, more technical and detailed. Finally, an implementation of MLS written in Rust and called Melissa will be illustrated, which provides all the basic functionalities indicated in the draft 05 version of the protocol.}, url = {https://amslaurea.unibo.it/id/eprint/18467/}, keywords = {Network Security,Messaging,MLS,Protocol,Ratchet Trees} } @mastersthesis{marstrander2023use, title={Use of Messaging Layer Security in a Military UAV Swarm}, author={Marstrander, Emil}, year={2023}, school={NTNU} } @online{soler2025mls_efficiency, ids={soler2025experimental}, author = {Soler, David and Dafonte, Carlos and Fern{\'a}ndez-Veiga, Manuel and Fern{\'a}ndez Vilas, Ana and N{\'o}voa, Francisco J.}, title = {Experimental analysis of efficiency of the messaging layer security for multiple delivery services}, date = {2025-02}, eprinttype = {arxiv}, eprint = {2502.18303}, eprintclass = {cs.CR}, publisher = {arXiv}, url = {https://arxiv.org/abs/2502.18303}, urldate = {2026-04-18}, langid = {english}, abstract = {The authors experimentally evaluate the performance of MLS across different delivery services. Results highlight scalability and efficiency trade-offs in practical deployments.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,performance,scalability,group messaging} } %%%ilmenau%%% @online{jaeger2025mls_signal_matrix, author = {Jaeger, Joseph and Kumar, Akshaya}, title = {Analyzing group chat encryption in MLS, session, signal, and matrix}, date = {2025}, eprinttype = {iacr}, eprint = {2025/554}, institution = {IACR Cryptology ePrint Archive}, url = {https://eprint.iacr.org/2025/554}, urldate = {2026-04-18}, langid = {english}, abstract = {This work compares encryption mechanisms across MLS, Signal, Session, and Matrix protocols. It evaluates their security guarantees, performance trade-offs, and suitability for large-scale group messaging.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,signal protocol,matrix protocol,secure messaging analysis} } @online{azari2024treekem, author = {Azari, Karen and Ellison, Andreas}, title = {Tighter provable security for TreeKEM}, date = {2024}, eprinttype = {iacr}, eprint = {2024/1878}, institution = {IACR Cryptology ePrint Archive}, url = {https://eprint.iacr.org/2024/1878}, urldate = {2026-04-18}, langid = {english}, abstract = {This paper improves the provable security guarantees of TreeKEM, the key management core of MLS. It provides tighter bounds and refined models for analyzing group key exchange protocols.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,treekem,group key exchange,provable security} } @online{soler2024attribute_mls, author = {Soler, David and Dafonte, Carlos and Fern{\'a}ndez-Veiga, Manuel and Fern{\'a}ndez Vilas, Ana and N{\'o}voa, Francisco J.}, title = {Attribute-based authentication in secure group messaging for distributed environments}, date = {2024-05}, eprinttype = {arxiv}, eprint = {2405.12042}, eprintclass = {cs.CR}, publisher = {arXiv}, url = {https://arxiv.org/abs/2405.12042}, urldate = {2026-04-18}, langid = {english}, abstract = {This paper proposes attribute-based authentication mechanisms for secure group messaging systems. It focuses on privacy-preserving identity management in distributed environments.}, keywords = {pqc,spqr,itzbund,ilmenau,mls,authentication,privacy,attribute-based credentials} } @online{kundu2026pqc_network_stack, author = {Kundu, Ashish and Chakraborty, Vishal and Kompella, Ramana}, title = {Post-quantum cryptographic analysis of message transformations across the network stack}, date = {2026-04}, eprinttype = {arxiv}, eprint = {2604.08480}, eprintclass = {cs.CR}, publisher = {arXiv}, url = {https://arxiv.org/abs/2604.08480}, urldate = {2026-04-18}, langid = {english}, abstract = {The work studies how post-quantum cryptographic mechanisms interact across different layers of the network stack. It analyzes transformation effects and security implications.}, keywords = {pqc,spqr,itzbund,ilmenau,post-quantum,network security,protocol stack} } @online{balbas2023senderkeys, author = {Balb{\'a}s, David and Collins, Daniel and Gajland, Phillip}, title = {Analysis and improvements of the sender keys protocol for group messaging}, date = {2023-01}, eprinttype = {arxiv}, eprint = {2301.07045}, eprintclass = {cs.CR}, publisher = {arXiv}, url = {https://arxiv.org/abs/2301.07045}, urldate = {2026-04-18}, langid = {english}, abstract = {This paper analyzes the Sender Keys protocol used in group messaging systems such as Signal. It identifies limitations and proposes improvements for stronger security guarantees.}, keywords = {pqc,spqr,itzbund,ilmenau,signal protocol,group messaging,double ratchet,security analysis} } @misc{cryptoeprint:2021/769, author = {Jacqueline Brendel and Rune Fiedler and Felix Günther and Christian Janson and Douglas Stebila}, title = {Post-quantum Asynchronous Deniable Key Exchange and the Signal Handshake}, howpublished = {Cryptology {ePrint} Archive, Paper 2021/769}, year = {2021}, doi = {10.1007/978-3-030-97131-1_1}, url = {https://eprint.iacr.org/2021/769}, keywords = {pqc,spqr,itzbund,ilmenau,signal protocol,group messaging,double ratchet,} } @online{auerbach2025pqc_signal_ratchet, author = {Auerbach, Benedikt and Dodis, Yevgeniy and Jost, Daniel and Katsumata, Shuichi and Prest, Thomas and Schmidt, Rolfe}, title = {Post-quantum ratcheting for Signal}, date = {2025-09}, institution = {NIST Sixth PQC Standardization Conference}, url = {https://csrc.nist.gov/csrc/media/events/2025/sixth-pqc-standardization-conference/post-quantum%20ratcheting%20for%20signal.pdf}, urldate = {2026-04-18}, langid = {english}, abstract = {The paper proposes post-quantum secure messaging constructions for Signal under strict bandwidth constraints. It replaces classical Diffie-Hellman-based ratcheting with post-quantum key encapsulation mechanisms and analyses trade-offs in performance, communication overhead, and security properties such as forward secrecy and post-compromise security in practical deployment scenarios.}, keywords = {pqc,spqr,ilmenau,signal protocol,post-quantum cryptography,ratcheting,secure messaging} }