• 0 Posts
  • 55 Comments
Joined 1 year ago
cake
Cake day: June 24th, 2023

help-circle













  • On my phone, so links may come later. It’s hard to find solid documentation on it, since their encryption extension is proprietary, but it’s been referenced as being based on the Signal Protocol. The Signal Protocol, or every implementation of it that I’ve seen, uses a central “trusted” repository of public keys to tell message originators query to encrypt the message to. For Signal, and I assume Google RCS, that central repository is Google. The protocol doesn’t allow for federation, so any system that is interoperable with Google RCS will rely on Google as the trusted authority.

    The private key part I’m much less sure of, since both the Signal and Google RCS clients are closed source. Signal makes you jump through hoops to add a new client, involving one of your currently installed clients. This suggests that Signal isn’t in possession of your private keys. On the other hand, all you need to set up a new Google client is your account password. This suggests that either your keys are held by Google (perhaps encrypted by your account password) or that new keys can be added without needing explicit involvement from current keys.

    Of course this is all speculation because the implementations aren’t available for inspection.