End-to-End Encryption in ActivityPub: Why It's Still a Long Way Off

Soatok, author of the technical blog of the same name, has published a piece on the prospects for end-to-end encryption (E2EE) in ActivityPub — the protocol underpinning federated social networks such as Mastodon and other services across the fediverse.

The post notes that, despite growing interest in the idea of secure messaging within decentralized social networks, a considerable amount of work still lies ahead before E2EE can be implemented in ActivityPub. The author points out that the list of open problems turns out to be far longer than one might assume from the way the topic is discussed in the community.

Why It's Hard

ActivityPub was designed from the outset to be open and federated, which creates a number of architectural challenges for adding end-to-end encryption. This is not just about the cryptography itself, but also about the adjacent questions — from compatibility with existing infrastructure to ensuring predictable behavior of clients and servers when handling encrypted messages.

The author examines the topic through the lens of the “long tail” of tasks — a multitude of small but necessary refinements, each of which may seem secondary on its own, but which together demand substantial effort from the protocol's developers and standardizers.

Context

End-to-end encryption in the fediverse is not a new topic: users and developers periodically point out that the open nature of ActivityPub makes private messaging within platforms built on it less secure than messengers designed with E2EE in mind from the start. Soatok's piece continues this discussion, drawing attention to the specific technical obstacles that remain unresolved for now.

The publication sparked a discussion in the Lobsters community, where readers share their views on how realistic full encryption in the protocol is and when it might arrive.

Source: Lobsters