Messaging Layer Security (MLS)¶
To enable support for MLS conversations you need to configure the wire-server
helm chart with a removal key. This key is used by the server to sign External Remove Proposals and enables the server to remove clients from MLS groups, e.g. when users leave conversations or delete their clients.
The removal key is configured at path galley.secrets.mlsPrivateKeys.removal
in the wire-server helm chart. You need to provide a variant for each supported ciphersuite:
ed25519
ecdsa_secp256r1_sha256
ecdsa_secp384r1_sha384
ecdsa_secp521r1_sha512
For example:
These private keys can be created with with these commands:
This is a sensitive configuration value. Consider using Helm/Helmfile’s support for managing secrets instead of putting this value in plaintext in a values.yaml
file.
In addition to removal keys, MLS needs to be explictly enabled in brig. This can be configured at brig.config.optSettings.setEnableMLS
, for example:
Finally, the webapp needs to enable made aware of MLS. This is done by setting the following environment variable for the web application:
and for the team settings web application:
As long as MLS is still an opt-in feature, please remember that in order to be able to use the MLS protocol when creating conversation on clients, the team administrator need to have opted in for the MLS feature in the team settings.