Really curious what the recommendation is to keep user DMs / Group DMs secure for the parties. Been reading on AES-256-GCM and ECDH to build around.
From what I understand,
each user generates their keys (public and private)
when interaction needs to occur, both parties need to compute a shared key using each others public keys.
now Alice, will use the shared key to create a cipher of the message she wants to send to Bob
the cipher itself is saved to the DB
Bob will also use that shared key to decrypt that cipher and read Alice's message.
repeat
There are other parts to this like the authentication (auth tag), but those are pretty self explanatory.
The shared key can remain on each users private domain, but each user will need to retrieve the others public key to create that shared key. Storing the public key of each user on the DB seems unsafe?
Imagine Twitter-esque DMing/Group DMing but E2EE, keeping the messages secure in the DB, authenticated, and immutable.
Some input would be helpful!