| Cryptographic Property | Legacy Pairwise Ratchet (v1 E2EE) | IETF MLS — RFC 9420 (Used in Wonek) | Why Users Notice the Difference |
|---|---|---|---|
| Member Key Update Cost | O(N) — scales linearly with devices | O(log N) via asynchronous ratcheting trees | Instant membership & key updates across multi-device groups |
| Multi-Device Synchronization | Separate pairwise session per linked device | Each authorized device is a first-class leaf node | Reliable sync across iPhone, iPad, Mac & Apple Watch |
| Forward Secrecy | Yes — per pairwise chain | Yes — epoch-based group key ratcheting | Past messages stay unreadable if future state is exposed |
| Post-Compromise Security | Requires pairwise message exchange with each peer | Single tree update heals group secret for all members | Faster cryptographic self-healing across entire rooms |
| Open IETF Standardization | Proprietary / de-facto variants | Peer-reviewed IETF RFC 9420 standard | Auditable, modern cryptographic design |
Why Multi-Device Apple Ecosystems Outgrew Pairwise Sessions
Suppose a 25-person project team uses iPhones, iPads, Macs, and Apple Watches—totaling nearly 80 active client endpoints. Under older pairwise encryption designs, adding or removing a teammate or rotating compromised keys requires linear work across dozens of individual sessions, often causing out-of-sync 'waiting for this message' placeholders.
MLS (RFC 9420) organizes authorized client devices as leaves in a balanced cryptographic tree (TreeKEM). Updating a device's leaf secret refreshes the shared epoch key in O(log N) operations—even when offline teammates are not currently connected.
Inside Wonek's Native Rust Cryptographic Core & Noise QR Enrollment
In Wonek, plaintext never leaves your device unencrypted. Encryption and key schedule derivation run inside a memory-safe native Rust cryptographic core shared across Apple platforms.
When you add your Mac or iPad to your account, Wonek does not upload raw private keys to a cloud backup. Instead, you scan an authenticated QR code that establishes a direct Noise-protocol encrypted enrollment channel between your existing iPhone and the new device.
- Install Wonek on your primary iPhone and generate device-local cryptographic identity keys in the native Rust core.
- Open Wonek on your Mac or iPad and scan the enrollment QR code to complete an authenticated Noise-protocol device handshake.
- Create 1:1 or group conversations where every message, voice/video call key, CRDT document update, and file transfer is protected under MLS (RFC 9420).
- Send messages freely to offline contacts—Wonek's offline server queue holds only opaque ciphertext until their devices reconnect.
What Servers and Relays Can—and Cannot—See
Wonek's signaling infrastructure, offline message queues, and fallback media relays never possess group epoch keys or private device keys. Combined with QUIC / WebTransport TLS 1.3 wire encryption, infrastructure nodes handle exclusively encrypted payloads.
Practical Readiness Checklist
Stored locally in your browser—nothing leaves your device.
Frequently Asked Questions
Is end-to-end encryption enabled by default in Wonek group chats?
Yes. Unlike messengers where only 1:1 'Secret Chats' are end-to-end encrypted, Wonek applies MLS (RFC 9420) end-to-end encryption by default across 1:1 chats, group chats, voice/video calls, screen sharing, and file transfers.
How do offline messages work with end-to-end encryption?
When a recipient's device is offline or in Airplane Mode, Wonek queues the already-encrypted MLS ciphertext on the server and delivers it the moment their device reconnects. The server cannot decrypt the queued payload.
How does QR multi-device linking protect my keys?
Scanning the enrollment QR establishes a mutually authenticated Noise-protocol channel directly between your trusted device and the new Apple device, preventing man-in-the-middle server key injection.
Related Guides & Comparison
Keeping Encrypted Voice & Video Calls Alive When Switching Between Wi-Fi and 5G
Why walking out your front door drops traditional VoIP calls, and how QUIC connection resilience keeps Wonek E2EE voice and video calls smooth across networks.
End-to-End Encrypted Screen Sharing Across iPhone, iPad, and Mac
Share code, financial spreadsheets, medical portals, or family device settings privately with end-to-end encrypted P2P screen sharing on iPhone, iPad, and Mac.