nextcloud / nextcloud/spreed

Allow server/client-side encryption of chats

Open
#1,437 26 comments 40 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement feature: chat 💬 technical debt
Dominant language
PHP
Stars
2.2k
Forks
587
Avg merge
18h 27m
Merged PRs (30d)
333

Description

Feature request

Chats should be stored encrypted with user/server keys.

Ideally this should include:

  • encryption of text message content so that it is not stored in plaintext in the database;
  • an architecture where the server cannot trivially read message contents;
  • proper key handling for users/devices;
  • support for message history in a secure way;
  • clear documentation about the security model and limitations.
Current drawbacks
  • Message search is relying on plain text and will be unavailable / problematic to implement
Possible solutions
  • Create some chats as encrypted, warning that message search will not work for these messages

See also:

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by reviewing the existing encryption discussion in #37 and the related security requests, then define the client/server key-handling and message-history boundaries. Done should include an agreed security model, encrypted storage behavior, documented limitations, and an explicit decision about message search.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
backend, databases, frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.