Split out of #403 (item 7, not explicitly called out in the original comment but flagged during triage).
The current design derives one static per-room chat/signaling secret pair from the invitation secret for the whole session (service/src/crypto/inviteCrypto.ts, deriveChannelSecrets()), with no per-message key ratcheting. If that derived secret is ever compromised, the entire conversation (past messages captured off the wire, and any future messages until the room is torn down) can be decrypted — there's no forward secrecy within a session.
Proposed scope:
- Evaluate options: a full Double Ratchet (Signal-style, highest complexity/cost) vs. a lighter symmetric-ratchet-only scheme (rotate a message key forward via HKDF per message, no DH ratchet) that would still meaningfully bound the blast radius of a key compromise.
- Should be implemented as a new
EncryptionStrategy (or a wrapper around the existing AES-256-GCM one) so it's selectable via the existing pluggable-strategy registry (crypto/registry.ts) rather than a breaking change to the default.
Sequencing: recommend landing after #447 (key-exchange hardening) merges/rebases, since ratcheting design depends on a settled key-exchange mechanism to build on.
Split out of #403 (item 7, not explicitly called out in the original comment but flagged during triage).
The current design derives one static per-room chat/signaling secret pair from the invitation secret for the whole session (
service/src/crypto/inviteCrypto.ts,deriveChannelSecrets()), with no per-message key ratcheting. If that derived secret is ever compromised, the entire conversation (past messages captured off the wire, and any future messages until the room is torn down) can be decrypted — there's no forward secrecy within a session.Proposed scope:
EncryptionStrategy(or a wrapper around the existing AES-256-GCM one) so it's selectable via the existing pluggable-strategy registry (crypto/registry.ts) rather than a breaking change to the default.Sequencing: recommend landing after #447 (key-exchange hardening) merges/rebases, since ratcheting design depends on a settled key-exchange mechanism to build on.