Cloudflare has introduced end-to-end encryption (E2EE) to its video calling app, Orange Meets, and open-sourced the project for greater transparency. Originally launched last year as a demo for Cloudflare Calls, Orange Meets now offers a secure option for video calling, particularly useful for developers, researchers, and privacy enthusiasts.
The encryption feature is based on Messaging Layer Security (MLS), a group key exchange protocol standardized by the Internet Engineering Task Force (IETF). Orange Meets uses a Rust-based implementation of MLS, which enables secure group key exchange, forward secrecy, post-compromise security, and scalability. Encryption is entirely handled on the client side using WebRTC, meaning neither Cloudflare nor the Selective Forwarding Unit (SFU) can access the communication data.
To manage dynamic group changes during a call, such as users joining or leaving, Cloudflare has introduced a Designated Committer Algorithm. This system automatically assigns one participant as the committer to update the MLS state and securely manages group membership. If the committer leaves the session, a new one is automatically selected.
Each video session displays a “safety number” that represents the cryptographic state of the group. Users are encouraged to verify this number outside the app to prevent attacks like “Monster-in-the-Middle” (MitM), where a server could potentially alter key information. To ensure the protocol works as expected in all situations, Cloudflare formally modeled the Designated Committer Algorithm using TLA+, a mathematical verification tool that checks for edge-case bugs.
It is important to note that Orange Meets is not a consumer-ready alternative to platforms like Zoom, Google Meet, or Signal. It is a technical demo intended to showcase secure video calling using MLS. The platform lacks advanced features and has not yet undergone extensive security audits. However, it serves as a strong foundation for developers interested in end-to-end encryption and group communication protocols.
Orange Meets can be accessed through a live demo online or set up using the open-source code available on GitHub.
Also read:Â Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter |The Mainstream formerly known as CIO News Whatsapp Channel | The Mainstream formerly known as CIO News Instagram
About us:
The Mainstream formerly known as CIO News is a premier platform dedicated to delivering latest news, updates, and insights from the tech industry. With its strong foundation of intellectual property and thought leadership, the platform is well-positioned to stay ahead of the curve and lead conversations about how technology shapes our world. From its early days as CIO News to its rebranding as The Mainstream on November 28, 2024, it has been expanding its global reach, targeting key markets in the Middle East & Africa, ASEAN, the USA, and the UK. The Mainstream is a vision to put technology at the center of every conversation, inspiring professionals and organizations to embrace the future of tech.
