SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-e2ee-group-members

Who can decrypt an end-to-end encrypted MLS application message?

Only members of the encrypted group can decrypt its payload.

Start playing free

  1. Every network router
  2. Members of that group ✔
  3. Any delivery server

Why: Messaging Layer Security encrypts application content for group endpoints. A delivery service can route ciphertext without receiving the group key needed to read the payload.

Huh, didn't know that: End-to-end protection can survive a compromised message delivery service.

The dad joke
The delivery server carried the envelope but was not on the guest list.
Like this card?
Play the game

References

Answer: Members of that group. Messaging Layer Security encrypts application content for group endpoints. A delivery service can route ciphertext without receiving the group key needed to read the payload.

  1. RFC 9750, Messaging Layer Security Architecture www.rfc-editor.org/rfc/rfc9750.html
    only other members of a given group can decrypt the payload of a given application message
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat can a messaging provider sometimes learn despite encrypted content?Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?

That's stuff everyone should know.