Encryption
Forward secrecy, explained
Without forward secrecy, a single long-lived key protects a whole conversation, and anybody who eventually obtains it — by seizing a device, by compelling a provider, or by breaking in — retrieves the entire history at once. This makes stored ciphertext permanently valuable to an attacker, which is precisely the assumption behind harvest-now-decrypt-later collection.
Forward secrecy is achieved by deriving a fresh key for each message or each short interval from the previous one, in a direction that cannot be reversed, and deleting the old one. The security therefore depends on deletion actually happening on the device, which is why forward secrecy is a property of an implementation as much as of a protocol.
How Enclessa uses it
Enclessa gets forward secrecy from MLS itself rather than from a policy: every epoch change ratchets the group key forwards and the previous secret is discarded. This applies to end-to-end encrypted direct messages. Managed channels do not have it, because the server holds a key by design so that search and export can work — which is the trade the room mode makes explicit at the moment a room is created.