Skip to content
Enclessa
Get started

Glossary · Encryption

OpenMLS

All termsHow Enclessa secures data

OpenMLS is an open-source implementation of the MLS protocol written in Rust, developed in the open by contributors from Phoenix R&D, Wire and Cryspen, and subjected to external security review.

Open betaThe platform is being built in the open, so parts of it are not there yet, behaviour changes between releases, and no availability figure is committed while it is in beta. What is still being built.

What OpenMLS means

A protocol specification is not a working system. Between RFC 9420 and a message somebody can read there is a state machine, a key schedule, a credential system and a storage layer, each of which can be got wrong in ways that silently remove the guarantee. Using a shared implementation means that review effort concentrates in one place instead of being spread thinly across every vendor writing their own.

OpenMLS is written in Rust, which removes the class of memory-safety defects that has historically dominated cryptographic library vulnerabilities, and it compiles to WebAssembly, which is what allows the same compiled code to run in a browser as in a native application. It exposes a storage trait rather than dictating a database, so the host application decides how group state is persisted.

Choosing an audited third-party library is a trade: it removes the ability to shape the cryptography to the product, and it removes the temptation to. For a team that is not a cryptography research group, that trade is almost always the right one, and the alternative — a bespoke protocol described in marketing copy — is the single most common warning sign in encrypted messaging products.

How Enclessa uses it

Enclessa builds its cryptographic core, `mls-core`, as a thin Rust wrapper around OpenMLS, compiled to WebAssembly for the web client and linked natively elsewhere. Enclessa writes no cryptographic primitives of its own. The library is audited; Enclessa’s own integration of it has not been through a third-party audit, which is stated plainly on the security page rather than left to be discovered.

Where OpenMLS is specified

Related terms

MLS (RFC 9420)MLS, or Messaging Layer Security, is the IETF standard published as RFC 9420 for end-to-end encrypted group messaging, designed so that adding or removing a member costs work proportional to the logarithm of the group size rather than to the group size itself.Read the entryEnd-to-end encryptionEnd-to-end encryption is a design in which a message is encrypted on the sending device and decrypted only on the receiving devices, so that the server carrying it holds no key that can open it.Read the entryForward secrecyForward secrecy is the property that compromising a key today does not allow the messages sent before that compromise to be decrypted, because the keys that protected them have already been destroyed.Read the entry

Read further

The security page explains how Enclessa protects data and which certifications it does not hold. The trust centre covers the processing agreement, the subprocessors and the residency position. The FAQ answers the questions buyers ask most often.

Encrypted collaboration, hosted in Europe.

Create a workspace in a couple of minutes. It is yours at your-team.enclessa.app, hosted in the European Union, with encrypted direct messages from the first one you send.

Create your workspaceSee pricing

Open beta. Free plan, no payment card to start.