There's no such thing as a group envelope
Your family circle feels like one conversation: you share a position, everyone sees it. Under the hood, that sentence hides a problem that has occupied cryptographers for years. The sealed envelope we keep describing is a fundamentally two-person object: locked on your phone, unlocked on one other phone. There is no padlock that three people can each open with three different private keys.
So every end-to-end encrypted app with groups has to pick a trick. There are two, they trade different things away, and Fenzly deliberately picked the stubborn one. This post explains both, and the price we pay for our choice.
The industry shortcut: one key for the whole room
The popular trick works like this. When a group is created, each member generates a sending key for that group, and hands it once, through secure pairwise envelopes, to every other member. From then on, sending a message to the group costs one encryption: everyone already holds the key that opens it. Most large messengers use a variant of this, and Matrix has its own version for big rooms.
It’s a perfectly honourable trade, because for big groups it’s the only one that scales: one encryption per message whether the room has ten members or ten thousand.
But look at what was traded away. The “fresh lock for every message” property now has an asterisk: the same sending key opens a whole run of messages until it’s rotated, so one leaked key reads more than one message. Self-healing after a compromise only happens when keys rotate, not continuously. And every membership change triggers a rekeying ceremony, new keys distributed to everyone, which is exactly the kind of bookkeeping where group-messaging bugs have historically lived. None of this is scandalous; it’s the documented cost of the shortcut.
Fenzly’s choice: no shortcut
A Fenzly circle message takes the stubborn path: one individually sealed envelope per member, every time. When you share a position with a circle of six, your phone seals it five times, once per other member, each through its own private two-person channel with its own ever-turning ratchet.
What that buys, concretely:
Every message to every member keeps the full two-person guarantees, forward secrecy with a genuinely fresh lock each time, and continuous self-healing, with no group-wide key whose leak would open a run of messages.
Membership changes stop being ceremonies. Removing someone from a circle means your phone simply stops sealing envelopes for them; there’s no group key to rotate, no window where a mistake leaves the departed member reading. Adding someone means starting to seal for them. The hard part of group cryptography, the rekeying choreography, simply doesn’t exist here.
And one more consequence, quieter but dear to us: a shared group key usually needs somebody to coordinate its distribution, which in practice drags the server into knowing who’s in the group. Pairwise envelopes don’t. That’s part of how the server can be structurally ignorant of your circles: it sees envelopes leaving to recipients the sender named, and nothing else.
The price, honestly
The cost is arithmetic and we won’t hide it: sealing once per member means a circle of ten costs nine encryptions per message, where the shortcut costs one. Engineers call this O(n), the work grows with the group size.
Here’s why we signed anyway. A position update is a few hundred bytes, and one sealing operation takes well under a millisecond on any modern phone. Nine of them is still nothing, invisible next to what the GPS or the screen consume. The trade only turns bad somewhere around rooms of hundreds, and that’s the point: Fenzly is built for circles, not stadiums. A family, a few close friends, a small team. At that scale, the stubborn path costs nothing measurable and gives up nothing at all.
The honest corollary: don’t expect thousand-member groups in Fenzly, ever. That’s not a missing feature; it’s the deal we struck, strongest guarantees at family scale, in exchange for not pretending to be a social network.
And the limit that never goes away: the server still sees that something left your phone towards N recipients. Content is sealed; the existence of traffic isn’t, as we’ve said before.
One question remains from this whole chapter: the machinery doing all this sealing, where does it actually come from? Next time: Olm and Matrix, the origin, the audits, and who else trusts the engine inside Fenzly.