The server must deliver what it cannot read
A messaging product where the operator is treated as untrusted for content. People have several devices each, messages must arrive while a device is offline, and a phone that is asleep has to be woken by the platform's own push service — which belongs to somebody else entirely.
Every capability you take away from the server has to be replaced by something the endpoints do for themselves. Work out which components are left holding an envelope rather than a letter.
- R1The thing that carries messages must be able to address them and unable to read them, and it must hold them for a device that is offline until that device collects them. It never re-encrypts anything, because it has nothing to re-encrypt with.
- R2Waking a sleeping phone means going through the platform's own push service, which is a third party. Whatever talks to it holds the credentials for doing so — the messaging side must not — and the notification it sends carries identifiers only, never content, because it passes through somebody else's infrastructure.
- R3A sender must be able to start an encrypted conversation while the recipient is offline, which means fetching published key material for each of the recipient's devices from somewhere that keeps it. That material is public by design and must survive a restart.
Outside every boundary: A sleeping phone (one of several), Platform push (a third party), Encrypted attachments (opaque to everyone), Sender's device (encrypts per device), an empty slot for the carries it, cannot open it, tier 1, an empty slot for the wakes the phone, tells it nothing, tier 1, an empty slot for the what a sender fetches to begin, tier 2 Connections: Sender's device calls carries it, cannot open it — one ciphertext per device carries it, cannot open it publishes to wakes the phone, tells it nothing — identifiers only wakes the phone, tells it nothing sends outbound traffic to Platform push Platform push publishes to A sleeping phone A sleeping phone calls carries it, cannot open it — collects, decrypts Sender's device calls what a sender fetches to begin — whose devices Sender's device calls Encrypted attachments