MLS protocol (RFC 9420)
Last updated
MLS, the Messaging Layer Security protocol, is an IETF standard (RFC 9420) for end-to-end encrypted group messaging. It lets a group of participants share encryption keys efficiently and update them as members join or leave, so that only current members can read messages. MLS is designed to stay secure and efficient even for large groups, which is why it is a strong fit for encrypted group communication.
How it works
End-to-end encryption is straightforward for two parties but harder for a group, because every member needs the current keys and the group changes over time. MLS solves this with a structure called a ratchet tree, which lets the group derive and update shared secrets without every member doing work proportional to the group size.
When a member is added or removed, MLS performs a group operation that rotates keys, so a departing member cannot read future messages and a new member cannot read past ones. This gives forward secrecy and post-compromise security: even if keys leak, the exposure is bounded in time.
MLS was standardized by the IETF as RFC 9420 in 2023. It defines the key management and group agreement; the application still carries the ciphertext over whatever transport it uses.
Why it matters
MLS gives group messaging the same end-to-end guarantees that were previously practical mainly for one-to-one chats, and it does so at scale. Because it is an open IETF standard rather than a proprietary scheme, it can be independently reviewed and interoperated with.
For networks where messages pass through relays, this is essential: only group members hold keys, so intermediaries forward ciphertext they cannot read.
How it relates to Offline Protocol
Offline Protocol encrypts sessions with MLS (RFC 9420) by default. Identities are Ed25519 keypairs held on the device, and MLS manages the group keys for a session, so when messages relay across the mesh, relay nodes forward only ciphertext and keys never leave members’ devices.
This lets the mesh relay up to 8 hops without exposing content to intermediaries. See offline identity for how the underlying keypairs work and Ed25519 for the signature scheme.
Frequently asked questions
What is MLS used for?
MLS (RFC 9420) is used for end-to-end encrypted group messaging. It manages shared encryption keys for a group and updates them as members join or leave, so only current members can read messages.
What is RFC 9420?
RFC 9420 is the IETF standard that defines the Messaging Layer Security (MLS) protocol, published in 2023. It specifies how a group agrees on and rotates encryption keys efficiently and securely.
Can relay nodes read MLS-encrypted messages?
No. Only group members hold the keys. Relay nodes forward ciphertext, which is why Offline Protocol can relay messages across multiple hops without exposing their contents.
