Session Development Update - Pro Beta and Protocol v2

With the support of donations from the community, work has recommenced on Session earlier this month with a small team of three developers. The Future of Session has already set out the goals guiding this work: reducing the cost of maintaining Session, launch Session Pro Beta, and consolidate core functionality into a single shared library (libsession). This post covers ongoing progress towards these goals. 

Preparing to launch Session Pro Beta

Most of the remaining work on Pro is testing, release preparation, and strengthening the backend systems the features depend on.

Mobile and desktop testing infrastructure is now a single setup, so tests run across all platforms at once, and each backend service has a self-contained local environment for testing and iteration without external dependencies. Session Desktop's communication with the Pro backend has been reworked, making that layer more reliable and easier to maintain. Work has now started on the first end-to-end tests running across Desktop and mobile simultaneously.

Together with testing, recent work has involved working through and fixing remaining issues and concerns in the Session Pro backend code related to payment processing and providing clients with Session Pro Proofs (cryptographic signatures that certify their Pro status for others to verify). This work has then been trickling down into Session clients to adopt the features and improvements. Other, related work has focused on analysis and unification of behaviour across the three platforms (iOS, Android, and desktop) in preparation for a release.

Libsession and Session Protocol v2

Moving core functionality into libsession, a single shared library, cuts development overhead and will make Session more efficient to maintain and improve. Completing this work is also what makes Session Protocol v2, an updated protocol introducing Perfect Forward Secrecy (PFS) and post-quantum encryption (PQ), viable to launch in Session despite the smaller development team.

The PFS and PQ work carried out earlier this year, which was nearing completion before development paused, has been merged into a dedicated `pfs` branch and is being kept current, in lockstep with ongoing Pro development and bug fixes. This will ensure that Session Protocol v2 is ready to launch once the switch to the new libsession codebase is made.

While the libsession and Session Protocol v2 workstream is currently on hold pending the current Pro backend and client work, planning for community testing of Session Protocol v2 is underway.

Session Protocol v2 Alpha

Session Protocol v2 is a secondary priority following the launch of Pro. Plans are being explored to release the alpha version as a separate invite-only app, with Session Pro users getting first access, as well as a limited number of invite codes that can be shared with friends. 

This would let Pro users benefit from PFS before it reaches the main Session app, specifically for direct messages to begin with. Note that PFS will apply only when both conversation partners are using the v2 alpha. Users can run the alpha alongside the current Session app, with non-PFS message history from the past 14 days staying synced across the two clients. Following testing by Pro users and the wider community in a beta phase in the future, PFS and PQ will be integrated into the main Session app. 

PFS and Private Device Groups

As part of Session Protocol v2, a new security feature was developed in the form of a private device group for multi-device accounts. In current Session versions, any device with your Session seed simply shares access to the same account. But PFS, by its very nature, cannot use the main account seed (or anything derivable from it) for message encryption. 

As a result, in Session Protocol v2, multi-device accounts have been reconceptualized to share rotating private PFS and PQ encryption keys within a “device group.” A new device cannot join this device group without communicating with the other devices in the group, and only with user approval do existing devices share the encryption key with a new device. Lost, compromised, or inactive devices can be removed from the device group at any time, and only active devices ever have access to the account's rotating encryption keys used for decrypting incoming PFS and PQ encrypted messages.

Bug fixes

While the small number of contributors working on Session right now means development resources are highly constrained, bug fixes and app stability remain important with issues being tracked and addressed by developers when possible. An iOS release (2.15.4) was recently published to fix an issue where attachments in communities that were sent by Android devices couldn’t be downloaded. The release also included a few stability improvements. 

An issue with groups is also under investigation across platforms at present, with updates to follow. 

Donations

The app has been updated to reflect that Session is moving forward, and a call for donations will remain in place. Along with grants from non-profit organizations, community contributions are an important source of funding for Session's ongoing development and maintenance.

Donations can be made at getsession.org/donate.