From a quick scan of the PDF, it looks like their higher-level Matrix library mitigates attacks that Olm itself does not.
I'm not sure how I feel about that.
We're looking at ways to try to better split the higher level crypto stuff into another library (which we'll then get NCC to audit) - but until then matrix-{js,ios,react}-sdk have implemented it separately.
> "Due to the inherently asynchronous nature of mobile messengers, providing reliable Forward Secrecy on the end-to-end layer is difficult. Key negotiation for a new chat session would require the other party to be online before the first message can be sent. Experimental schemes like caching pre-generated temporary keys from the clients on the servers increase the server and protocol complexity, leading to lower reliability and more potential for mistakes that impact security. The user experience can also be diminished by events that are not under the control of the sender, for example when the recipient loses their phone's data, and along with it the ephemeral keys. Due to these and the following considerations, Threema has implemented Forward Secrecy on the transport layer only"
Moxie writing about forward secrecy and key derivation ratcheting in November 2003 [2]:
> "it's not clear why individual message level forward secrecy is necessary. Instant messaging sessions tend to be ephemeral, and the messages themselves tend to be in memory for the duration of the session, so it's not entirely obvious what immediate value a ratcheting forward secrecy protocol provides in that context. Simply doing an ephemeral Diffie-Hellman key exchange at the beginning of every session would probably be enough."
He then goes on to lay out why individual message level forward secrecy is nonetheless desirable; this is not quoted.
Moxie writing about forward secrecy and async messaging in August 2013 [3]:
> "On the other hand, iOS apps like Threema and the proposed Heml.is support asynchronous messaging, but do not provide forward secrecy. Users have static public keys that are maintained by a server, which anyone else can query and encrypt to without having to engage in a key exchange round trip to the user. This allows for the frictionless asynchronous experience that mobile users have come to expect, but unfortunately relies on an undesirable cryptographic protocol model (the PGP model) that is increasingly being seen as an architectural dead end.
[1] https://threema.ch/press-files/cryptography_whitepaper.pdf [2] https://whispersystems.org/blog/advanced-ratcheting/ [3] https://whispersystems.org/blog/asynchronous-security/
A critical thing is that the crypto library (olm) has had an independent security assessment from NCC Group: you can see their report at https://www.nccgroup.trust/us/our-research/matrix-olm-crypto...