Field Notes

entity

OpenMLS

StatusStableReviewdue UpdatedStands on4 sourcesSupportsnotes

OpenMLS is an open-source Rust implementation of the Messaging Layer Security protocol standardized as RFC 9420. It is a library rather than an application: a reusable building block that supplies MLS group key agreement to software needing end-to-end encryption, leaving identity, delivery, and metadata handling to the embedding system. It is released under the MIT license.

Maintainers

OpenMLS is co-maintained by Phoenix R&D and Cryspen, with five maintainers across the two companies and a wider contributor community. Maintainership transitioned to the newly incorporated Phoenix R&D in 2022, and Cryspen joined as co-maintainer later that year.1 The GitHub project now credits the Cryspen side to CE Labs, a Cryspen cryptographic-engineering spin-off. This lineage matters for the vault’s messaging analysis: Phoenix R&D co-authored the MLS specification, so OpenMLS is an implementation maintained in part by the standard’s authors.

Security audit

OpenMLS underwent its first independent security audit by SRLabs, a Berlin security firm, sponsored by the Sovereign Tech Agency. The engagement was a secure code review of the library, with the developers providing source access and protocol background. The final report (version 1.1, including mitigation checks) was dated 3 March 2026, and Phoenix R&D published its summary on 27 May 2026.1

SRLabs found eight issues, one rated High severity. Fixes for seven were merged and shipped in openmls crate versions 8.1 and 7.3; the remaining Low-severity issue was still being addressed when the summary was published. The audit summary does not name the High-severity issue in prose, deferring to the full report, so a reader who needs that detail should consult the report itself.

Relationship to the wiki

OpenMLS is the cryptographic core beneath Air, Phoenix R&D’s own MLS messenger. An audited Messaging Layer Security library is still not a complete secure messenger: RFC 9750 leaves delivery, identity, metadata, backup, and user verification to the surrounding product. The Jaeger and Kumar group chat encryption analysis reinforces this, finding construction-specific attacks that a clean library audit does not by itself foreclose at the deployed-system level.

  1. OpenMLS independent security audit (Phoenix R&D, 27 May 2026) reports the SRLabs findings, the Sovereign Tech Agency sponsorship, the maintainership history, and the crate versions carrying the fixes. ↩↩

Built on 4 sources (4 external).

Working out connections…