Matrix and End-to-End Encryption

What Matrix provides

Matrix is a federated open standard for real-time communication: chat, VoIP, IoT, file sharing. The unit of identity is @user:homeserver.tld; rooms span multiple homeservers via federation. Compared to Signal, it is more complex, more flexible, and leaks more metadata. Compared to Nostr, it has stronger consistency and weaker identity portability.

Pillars:

• Open spec — Matrix Specification (CS API, S2S API, AS API).
• Federated — homeservers exchange events; no single org runs the network.
• E2EE optional but default in Element — Olm (1:1) and Megolm (group).
• Rich room model — power levels, state events, persistent room state, threaded replies.
• Bridges — gateways to IRC, XMPP, Telegram, Discord, Signal, etc. (E2EE breaks at the bridge).

Encryption: Olm and Megolm

Olm — Double Ratchet variant

Per-device pairwise encryption. Equivalent design to Signal's Double Ratchet, adapted for Matrix's "many devices per user" model. Each user's devices have their own keys.

Megolm — group ratchet

For rooms, a sender publishes a session (a ratcheting symmetric chain) to all members. Members encrypt incoming Megolm sessions per-device using Olm. Properties:

• Forward secrecy: yes, per ratchet step.
• Post-compromise security: only on session rotation (which clients do periodically and on member changes).
• Membership privacy: limited; the homeserver knows the room roster.

Cross-signing and key verification

Identity verification across devices via cross-signed keys. UX is emoji or numeric short-code comparison. Reduces the TOFU footgun substantially since 2020.

MLS migration

Matrix has an MLS profile in development that replaces Olm/Megolm with the IETF MLS standard (RFC 9420). Production rollout is staged; stable group E2EE with TreeKEM for large rooms.

Federation model

homeserver A          homeserver B
   │                       │
@alice:A           @bob:B
   │                       │
   └── room !abc:A ────────┘
       events propagate via S2S API

The room is owned by its origin server and replicated to all servers with members. Server outages mean partial outages for that server's users; the room continues elsewhere.

What homeservers see

E2EE protects content; room participation, timing, and topology are not hidden at the federation layer.

Trade-offs vs Signal and Nostr

Implementations

Servers

• Synapse (reference, Python) — most-deployed; matures slowly.
• Dendrite (Go, microservices) — more performant.
• Conduit (Rust, single-binary) — community favorite for small homeservers.
• MAS (Matrix Authentication Service, OIDC bridge) — replaces password login for newer Synapse.

Clients

• Element (web, desktop, iOS, Android) — reference client.
• FluffyChat (Flutter) — multi-platform.
• Cinny (web) — Discord-like UI.
• Element X (Matrix Rust SDK) — newer, faster, sliding-sync-based.

Operational concerns

Self-hosting

A 100-user Synapse homeserver is feasible on a $10/month VPS, until it joins a popular room with thousands of remote members and storage explodes (the classic "join Matrix HQ" gotcha). Plan disk, plan database (Postgres), plan media storage (S3-compatible).

Privacy hardening

• Disable URL previews (the homeserver fetches URLs, leaking room contents).
• Disable presence unless needed.
• Use ephemeral or disposable MXIDs for sensitive joins.
• Pair E2EE with Tor SOCKS for the client.
• Audit room state for unwanted user-impersonating bots.

Account recovery

Cross-signing plus key backup means recovery is possible from a Recovery Key (essentially a passphrase-encrypted backup of decryption keys). Lose it AND all devices, and you cannot decrypt history.

Trade-offs

Strengths

• Rich, well-specified protocol. No reverse engineering.
• Federation removes single-org control. Matrix.org is one server, not the only one.
• Bridges to legacy networks. Pragmatic interoperability.
• Open, audited E2EE. Megolm has had bugs; they get fixed in the open.
• Strong group support. Multi-thousand-member encrypted rooms.

Limitations

• Metadata via federation. Homeservers see who is in which room.
• Complexity. Synapse is heavyweight; running it correctly takes care.
• Identity portability is poor today. Rebinding @old:A to @new:B loses follower-equivalent context.
• E2EE off by default in legacy contexts. Old public rooms are unencrypted; bridged rooms break encryption.
• Inconsistent client crypto correctness. Bugs surface at the boundary of Olm/Megolm and the room state machine.

Attack surface

Recent developments (2024-2026)

• MLS migration profile: partial rollout in Element X.
• Sliding Sync (MSC3575): dramatically faster client cold-start; deployed.
• Element X stable releases: Rust SDK reaches feature parity.
• MAS / OIDC: modern auth replacing password login.
• Account migration spec (MSC4133): early draft.

Primary Sources

• Matrix Specification — spec.matrix.org
• Olm specification — gitlab.matrix.org/matrix-org/olm
• Megolm specification — same repo.
• Hodgson, Matrix.org: an open standard for decentralised communication, FOSDEM talks 2014–2024.
• Matrix Foundation reports — matrix.org/blog
• RFC 9420, Messaging Layer Security — for the MLS migration.

Compare XMPP with OMEMO and Delta Chat in Choosing a private messenger.