Pairwise Double Ratchet remains rock-solid for simple two-phone messaging. For modern multi-device Apple ecosystems (iPhone + iPad + Mac + Apple Watch) and active group collaboration across chat, calls, files, and CRDT docs, IETF MLS (RFC 9420)—implemented in Wonek's native Rust cryptographic core—delivers dramatically cleaner O(log N) key rotation, faster post-compromise healing, and formal IETF standardization.
| Property | IETF MLS — RFC 9420 (Wonek) | Pairwise Double Ratchet + Sender Keys |
|---|---|---|
| Adding / Removing Member or Rotating Key | O(log N) via binary TreeKEM ratcheting tree | O(N) — linear pairwise fan-out to every device |
| Post-Compromise Security in Groups | Single Commit heals shared group secret for all | Requires full pairwise re-distribution when members change |
| Forward Secrecy | Continuous epoch & sender-ratchet forward secrecy | Strong per-chain forward secrecy |
| Multi-Device Representation | Native leaf per enrolled iPhone, iPad, Mac & Watch | Simulated as N separate pairwise chats ('sesame') |
| Asynchronous Offline Key Updates | Native KeyPackages allow updating while peers sleep | Prekeys work 1:1; group Sender Keys frequently desync |
| Standardization Status | Published IETF Standard RFC 9420 (2023) | De-facto industry specification (non-IETF RFC) |
Why TreeKEM Changes the Math of Multi-Device Groups
When Alice, Bob, and 28 teammates each carry an iPhone, an iPad, a Mac, and an Apple Watch, a single group room actually contains roughly 100 client devices. Pairwise protocols treat those 100 devices like 100 separate pipes whenever group keys rotate after a member leaves or recovers from compromise.
MLS (RFC 9420) arranges devices as leaves of a binary cryptographic tree (TreeKEM). Updating any device's secret hashes up only its direct path to the root—requiring roughly seven cryptographic operations instead of a hundred.
Ending 'Waiting for This Message' Multi-Device Desyncs
Because MLS was designed from scratch for asynchronous multi-device environments, waking up an iPad or Mac after days in a backpack syncs epochs cleanly without stranded pairwise sessions.
| Security Layer in Wonek | Technology Used | Security Guarantee |
|---|---|---|
| Group & 1:1 Content Layer | MLS (RFC 9420) in memory-safe Rust core | End-to-end confidentiality, authenticity, FS & PCS |
| Multi-Device Enrollment | Noise-protocol QR authenticated channel | Zero cloud private-key escrow when linking Mac/iPad/Watch |
| Wire Transport Layer | QUIC / WebTransport with mandatory TLS 1.3 | Dual-layer encryption against passive network snooping |
| Collaborative Docs State | Yjs/Yrs CRDT updates inside E2EE boundary | Conflict-free offline merges without server plaintext |
| Offline & Relay Nodes | Ciphertext-only queues & encrypted fallback relays | Servers never possess MLS epoch decryption keys |
Memory-Safe Rust Core + Noise QR Enrollment in Wonek
Wonek runs its MLS engine inside a native Rust library shared across iOS, iPadOS, macOS, and watchOS, pairing it with Noise-protocol QR device linking and QUIC TLS 1.3 transport.
| Real-World Situation | Pairwise / Sender Keys Quirk | MLS (RFC 9420) in Wonek |
|---|---|---|
| Opening your MacBook after a week offline | Slow catch-up or 'Waiting for this message' placeholders | Clean epoch tree sync across enrolled leaf devices |
| 25-person team with 4 Apple devices each (~100 leaves) | 100x pairwise key distribution overhead on membership change | ~7 tree steps (log2 100) to refresh group secret |
| Removing a departing contractor from 15 Work channels | Expensive full Sender Key resets across every device | Immediate O(log N) leaf removal & fresh epoch key |
| Rotating call & screen-share media keys | Separate ad-hoc group call key distribution | Derives authenticated epoch secrets cleanly from MLS group |
| Auditing protocol design | App-specific custom extensions for groups | Uniform peer-reviewed IETF RFC 9420 specification |
Frequently Asked Questions
Who standardized MLS (RFC 9420)?
Messaging Layer Security (RFC 9420) was developed over five years by the Internet Engineering Task Force (IETF) with academic cryptographers and major security engineering teams.
Does MLS still protect simple 1:1 chats just as strongly as groups?
Yes—a 1:1 chat across your iPhone, Mac, and Apple Watch is already a multi-device group of 4–6 endpoints! MLS provides forward secrecy and post-compromise security for both 1:1 and group conversations.
Where can I read more about Wonek's dual-layer security?
Visit https://wonek.com/security/ for a complete breakdown of Wonek's MLS E2EE, Noise QR linking, QUIC TLS 1.3 transport, and ciphertext-only server boundaries.
Related Comparisons & Deep-Dive Guide
Wonek vs Signal: Port-Predicted QUIC P2P, MLS Groups & Workspace Tools Compared
Compare Wonek vs Signal across mobile CGNAT P2P calls, QUIC/WebTransport, MLS (RFC 9420) encryption, CRDT docs, shared calendars, and Apple Watch support.
Wonek vs WhatsApp: Zero Ad-Ecosystem Metadata, QUIC P2P & Work Profiles
Compare Wonek vs Meta WhatsApp: MLS (RFC 9420) E2EE without ad-ecosystem profiling, direct CGNAT P2P over QUIC, resumable files, CRDT docs, and Apple Watch.