In this blog post, we will explore Message Layer Security (MLS), the current ecosystem, the goals it sets to achieve, and why this groundbreaking technology has the potential to impact industry standards when it comes to secure group communication within organisations.

 

What is Messaging Layer Security?

Message Layer Security, also known by the shorter acronym of MLS, is a protocol currently in development by the likes of Google, Facebook, Mozilla and Cisco that will make online collaboration, specifically messaging and video conferencing software, much more secure than current systems and architecture.

The protocol is being created by the Internet Engineering Task Force, which includes the aforementioned members. The initial focus was on creating an open standard, but other contributors including the University of Oxford, Facebook, INRIA, MIT, Google and Twitter later joined the effort and brought more innovation to the table.

Driving factors behind the development of MLS

There are three driving factors behind the development of MLS, these include:

• Improving the efficiency of large groups in messaging, audio and video calls to improve quality even when there are thousands of people on the call.
• Only improve the security of large groups of people on messaging and conferencing platforms, while at the same time maintaining the security of systems such as Forward Secrecy and Post-Compromise Security.
• Create a new standard that can be used by the entire industry, including the likes of Microsoft, Google, Slack and all platforms with such communications at the heart of what they offer, to enable interoperability.

Bringing MLS to the frontier of secure collaboration

While personal messaging systems are increasingly adopting end-to-end encryption, corporate messaging has failed to follow. A majority of organisations are still heavily relying on email communication, a tool that has proven an open door to cyber threats.

Messaging platforms offer a great solution to email, but in their current state, they are simply too insecure. This is what MLS aims to fix, with an open standard for all messaging platforms.

Goals of MLS

MLS brings together some of the world’s largest tech companies and renowned academics with a common vision of transforming enterprise communication, ensuring that now and in the future platforms can be interconnected seamlessly and in a standardised way.

The MLS protocol’s most significant goal is to make end-to-end encrypted messaging in large groups efficient and more secure as well as to become an open standard for all industries. The MLS group messaging protocol aims to cover multiple industry use-cases including federation and web-browser support, to have sub-linear complexities allowing practical groups of thousands of clients, and to provide formal security guarantees.

Messaging apps are now offering end-to-end security mechanisms more than ever, to help make sure that messages are seen only by those at each end of the communication, and not anyone in between who may have once found access via the servers involved in relaying messages. A key factor of the MLS group protocol is that it works with large groups, providing top security for messages and communications even for groups in the tens of thousands.

Why it is important

The world needs more secure messaging, specifically, federated environments based on open standards. There is significant importance in using open standards over proprietary technology and past experience has shown this need not get in the way of private companies’ profitability.

Take technology such as WebRTC, for example, which was once at the same stage of development as MLS is today. It is now built into most browsers (Chrome, Firefox etc.) meaning it is literally built into billions of apps and devices.

Today’s world needs secure messaging more than ever

It hardly needs pointing out that the current climate means online security, specifically with regards to online communications, is needed more than ever. Due to COVID-19, every company in the world has been thrust into remote working and digitisation. Their lack of knowledge around secure systems for collaboration is a hacker’s dream scenario.

We have already seen the likes of the UK government sharing screenshots of Zoom calls with their meeting ID clearly in view, and we know most homeworkers are using unsecured WiFi, and often on non-business devices, meaning shadow IT is a serious problem, as well as prolific.

Future of secure messaging

So, it only makes sense that the next decade of messaging will be shaped by the increasing awareness of users around subjects like privacy and security.

Open standards have time and time again shown their benefits are far beyond that of propriety technology. Not only in terms of creating federated platforms where interoperability between competing products provides benefits to users, but also in terms of the heightened security that open standards provide - they are kept in check and updated far more often, and therefore are the future of message security too.