Layered Trust and Message Verification Model

Traditional secure messaging has binary trust: either you can decrypt messages or you can’t. Cryptid separates two questions that the binary model conflates:

1. Was this message genuinely sent by a group member?
2. Do I know who that member actually is?

The first is answered cryptographically and is never in doubt. The second is a human question, and it does not gate communication.

Layer 1: MLS Group Trust

• Provides message authenticity within the group
• Enables immediate communication for new group members
• Guarantees messages come from legitimate group participants

Layer 2: Direct Contact Trust

• Provides enhanced identity verification
• Enables high security communications when needed
• Guarantees messages come from the specific person you verified out-of-band

Authenticity Is Not a Trust Level

MLS authenticates every application message against the sender’s credential in the ratchet tree. A message that decrypts was provably sent by a current member of that group. There is no separate signature to verify, and now way for a non-member to produce one.

Trust levels therefore describe identity verification, never authenticity. A GroupMember message is exactly as authentic as a DirectContact message. The difference is whether you have confirmed who that device belongs to.

Caution

The sender MUST be taken from the MLS-authenticated credential, never from InnerEnvelope.sender_device_id.

That field sits outside the MLS ciphertext, covered only by the outer HPKE seal. Every group member holds your mailbox public key, so any of them can seal an envelope declaring any sender_device_id they like. It is a routing and diagnostic hint. Only the credential recovered from MLS decryption identifies the sender.

InnerEnvelope Structure

struct InnerEnvelope {
    // Sender's device (from MLS authenticated data)
    sender_device_id: DeviceId,

    // Group ID (None for ContactRequest)
    group_id: Option<GroupId>,

    // MLS-encrypted message content
    mls_ciphertext: Vec<u8>,
}

Trust Level Classification

enum MessageTrustLevel {
    /// Highest trust: sender is a group member you verified out-of-band
    DirectContact,

    /// Normal: sender is authenticated by MLS but not personally verified
    GroupMember,

    /// Error: MLS authenticated device absent from the local roster.
    /// Indicates roster desync, not an untrusted message.
    Unknown,
}

struct GroupMember {
    /// Blake3 hash of the device public key, from the MLS credential
    device_id: [u8; 32],

    /// From MLS group context
    public_key: Ed25519PublicKey,

    /// This member's mailbox for *this* group. Members present a different
    /// address in every group they share with you
    delivery_address: DeliveryAddress,

    /// Which member added them
    added_by: [u8; 32],
    added_at: u64,

    participation_status: ParticipantStatus,
}

enum ParticipantStatus {
    /// Currently participating in the group
    Active,

    /// Added but hasn't joined the group yet
    PendingWelcome,

    /// No longer in the group
    Left,
}

Message Verification Process

All group members can communicate immediately. Verification affects trust indicators, not communication ability.

fn verify_and_decrypt_group_message(
    inner: &InnerEnvelope,
    group: &MLSGroup,
    contacts: &ContactStore,
) -> Result<(String, MessageTrustLevel)> {
    // 1. MLS decryption *is* the authentication. Success proves the message
    //    came from a current group member. Failure means the message is
    //    forged, replayed, or for another epoch. There is no partial state.
    let decrypted = group.decrypt(&inner.mls_ciphertext)?;

    // 2. Authoritative sender identity, from the MLS credential.
    //    inner.sender_device_id is NOT used here, see above for why.
    let sender = decrypted.sender_device_id;

    // 3. Trust level reflects out-of-band verification only
    let trust_level = match contacts.get(&sender) {
        Some(contact) if contact.verified => MessageTrustLevel::DirectContact,
        Some(_) => MessageTrustLevel::GroupMember,
        None if group.has_member(&sender) => MessageTrustLevel::GroupMember,
        None => MessageTrustLevel::Unknown,
    };

    Ok((decrypted.plaintext, trust_level))
}

There is no separate signature check because MLS already performs that. There is no address lookup, because the envelope carries no sender address and a member’s address differs per group. There is no failure path that yields an authentic-but-untrusted message.

Verifying a Contact

Upgrading a member from GroupMember to DirectContact is an out-of-band act: scan their QR code or compare fingerprints, then store their User Identity and device keys in the contact store. Nothing about the group changes, and no message is re-verified. The trust indicator on their past and future messages simply changes.

Key Points

• Assume there’s a group consisting of Alice, Bob, and Steve
• Bob adds Carol to the group
• Carol’s messages appear immediately to all group members, authenticated by MLS
• Trust indicators show verification status without blocking communication
• Users can upgrade trust by scanning QR codes for direct contact verification
• Group participation doesn’t require prior contact relationships
• Carol presents a different delivery address in this group than in any other, so members of two groups she shares cannot link her by address though her device_id is visible in both, by design