Encrypting the content once does not eliminate the cost of distributing keys and delivering the message to every member.
In the “Sender Key” architecture, a sender does not need to encrypt the same content separately for every group member. Each sender has their own key chain and delivers the key material needed to read their messages to authorized members through a secure path. This approach reduces content-encryption costs; key distribution, message delivery and membership management still have costs.
How is LGS1 described in Livara?
According to Livara’s security documentation, LGS1 uses a separate chain and signing key for each sender for compatible private-group messages in E2EE mode. Sender keys are distributed through pairwise LVR1 sessions; a message key is then derived for each chain position. The documentation also describes key rotation after members join or leave. This is a description of the product architecture, not a performance-test result or an independent audit by this article.
The path of a group message, step by step
- Preparing members: The device must verify recipients’ cryptographic identities and authorized membership.
- Distributing the sender key: The necessary information reaches members through private sessions. For a large group, this step is neither free nor independent of the number of members.
- Deriving the message key: The chain advances so that different contents are not encrypted with the same message key.
- Encryption and authentication: The content is encrypted, and the recipient must verify the message’s integrity and the sender’s identity.
- Membership changes: Keys for the next epoch must be available only to the remaining authorized members.
“Sender Key” should not be equated with permanently using one AES key for all messages. Chain state, message number and key epoch are part of a secure design.
Which costs decrease, and which remain?
| Part of the work | Effect of Sender Key architecture |
|---|---|
| Encrypting the content of an ordinary message | Can be performed once, instead of producing a separately encrypted copy for each recipient |
| Distributing initial or fresh keys | Must cover authorized members; the number of members and devices matters |
| Network transmission to all members | Still requires delivering data to recipients |
| A member leaving and an offline device | Require epoch management, coordination and clearly defined failure behavior |
The statement “the total group cost drops from O(N) to O(1)” is therefore inaccurate. One can discuss a particular operation, not the entire network. Speed, battery use and data consumption must also be measured for a specific app version, member count and set of devices.
Where does post-quantum protection come in?
Livara relates group-key distribution to hybrid LVR1 sessions. The presence of a post-quantum component does not, by itself, prove every group property: key combination, signatures, state handling and membership validation also matter. Standardizing an algorithm is different from approving the security of an entire messenger.
For comparing architectures, RFC 9420 on MLS provides an example of a formal group-key-management specification. LGS1 must not be presented as MLS itself or an implementation of it; each protocol’s guarantees must be read from its own specification and evidence.
What should we check before trusting a private group?
- Is the group itself actually using end-to-end encryption? Livara’s documentation says an incompatible legacy group should not be labeled encrypted without justification.
- Who can add members, and how are members informed of a change?
- Can a new member access past history or only future messages? Check the answer for that same app version.
- Does the key epoch change after a member is removed? Removal from the list alone is not proof of a key change.
- Can current members copy a message? Yes; encryption does not eliminate the need to trust the recipient.
Frequently asked questions
Does removing a member erase their old messages?
No. Key rotation is intended to restrict future access; a copy already received or saved is not necessarily erased from the removed member’s device.
Does LGS1 deliver messages during a complete network outage?
Encryption does not create a communication path. Message delivery requires devices to have access to the service and a network path; distinguish content security from availability.
Does the server have no information about the group?
According to Livara’s stated boundaries, content confidentiality does not mean that all operational information is hidden. When choosing a group, also read the membership and metadata policies.
