RCS Encryption stopped working

[brokoler]

Hello,

I was successfully using Google Messages with RCS Encryption on GOS, with all settings enabled per following guide: https://grapheneos.org/usage#rcs

For all my chats with Android users who were also using Google Messages, a lock symbol was shown and additionally for each chat the app informed me that E2E encryption is enabled. This was working until recently I reinstalled Google Messages, since then no lock symbols are shown and the app doesn't mention E2E encryption anymore. Per Google descritpion E2E encrption is now not active anymore, the lock symbol is the mandatory indicator: https://support.google.com/messages/answer/10252671?hl

RCS itself can still be used with GOS, but the encryption is missing. I'm not sure why this started happening based on a reinstall of the app but something seems broken now. Hope others users can share their findings after reinstalling Google Messages on GOS and this issue can be fixed.

[thestinger]

Install Android System Key Verifier and see if that fixes it.

[brokoler]

It couldn't be fixed by installing Android System Key Verifier:

• Installed Android System Key Verifier and rebooted the phone, same issue
• Afterwards completely uninstalled Google Messages and reinstalled it again (set to default SMS app), same issue
• Rebooted the phone one more time, same issue

[inthewaves]

I'm unable to reproduce, as uninstalling the Google Messages app and reinstalling from the Play Store made RCS chats stay E2EE on two different devices on two different carriers

• What is the installed version of Play services in the GrapheneOS App Store?
• Is the uninstall process just uninstalling the app and reinstalling it from the Google Play Store?
• Have you tried opting into the beta version of Google Messages in the Google Play Store?

After another reinstall, please share logs to logs@grapheneos.org with a reference to this issue (#7874) from long pressing Google Messages in launcher or recents > App info > View logs

[brokoler]

To answer your questions:

• Two play store versions were tested, release channel Stable and Alpha. Currently alpha in version 26.16.31 is installed
• Yes, the uninstall process is deleting the app and reinstalling from Play Store including setting Messages to the default SMS app and then opening the Google Messages app
• Two Google Messages versions were tested, the Stable and the Beta. Currently the beta in version 20260522_00_RC00 is installed

There was no difference between the chosen versions of Play Services and Google Messages with the exact same issue behavior.
I also recognized that my contacts also using Google Messages do see the chats with my device encrypted, but my device does not show them as encrypted. Logs of Messages app were sent to logs@grapheneos.org.

Edit: Tested with GOS build number 2026052401

Thanks for your support!

[inthewaves]

Etouffee (Google Messages' E2EE provisioning layer) seems to be succeeding:

05-28 08:58:34.748  9939  9961 I BugleNetwork: RegistrationProvider: Received Tachyon registration refresh token
...
05-28 08:58:34.764  9939  9987 I BugleE2eeEtouffee: EtouffeeStateMachine: onRegistrationUpdate from Tachyon, previousState: REGISTERED_WITH_PREKEYS, newState: REGISTERED_WITH_PREKEYS, reason: TACHYON_UPDATE_REFRESH
05-28 08:58:34.764  9939  9987 I BugleE2eeEtouffee: EtouffeeStateMachine: E2EE provisioning state update, Previous Etouffee status: PROVISIONED, New Etouffee status: PROVISIONED
05-28 08:58:34.767  9939 10281 I BugleE2eeMls: Finished downloading certs, uploading keypackages, and refreshing capabilities [CONTEXT provisioning_session_id="..." ]

The log shows one of your conversations was able to self-repair itself (conversation_id="1"). It starts off as not encrypted:

05-28 08:59:30.866 10485 10561 I BugleConversation: Compose Constraints: Not encrypted. isSelfIdentityEncryptionEnabled=true, conversation.isEncrypted=false. [CONTEXT conversation_id="1" ]

The remote identity is MLS capable:

08:59:30.902 Checked standard MLS capabilities for 1 users. Result: true
08:59:30.905 Executing ClaimKeyPackagesRpc ... requested key packages for 1 users

The first MLS create attempt fails because the server already has an MLS group for this 1:1 conversation, then the app handles it and attaches that existing MLS group back to the local conversation:

05-28 08:59:31.495 10485 10536 W BugleE2eeMls: Ignoring RPC error for message MxJam6Z1rgS-m4oru9SV4zcQ since it has mlsError INCORRECT_ERA. Expecting a negative IMDN.
05-28 08:59:31.495 10485 10693 I BugleBanners: Add contact banner is dismissed and first incoming [CONTEXT is_dismissed=false is_first_incoming_message=false ]
05-28 08:59:31.496 10485 10534 W BugleE2eeMls: RPC CreateMlsConversation failed with MlsError INCORRECT_ERA, Skip updating conversation to MLS. [CONTEXT class_name="UpgradeToMlsOperation" conversation_id="1" rcs_group_id="redacted-pii[36-chars]" ]
05-28 08:59:31.496 10485 10534 W BugleE2eeMls: io.grpc.StatusException: INVALID_ARGUMENT: Era changed from 1 to 1
...
05-28 08:59:31.827 10485 10690 I BugleE2eeMls: Received a negative IMDN indicating that the 1:1 conversation already has an MLS group on the server. Attempting to re-attach that group to the Bugle conversation. [CONTEXT class_name="CreateMlsConversationRpcHandler" ]
...
05-28 08:59:31.848 10485 10690 I BugleE2ee: Encryption protocol EncryptionProtocol(value=2) is added. [CONTEXT conversation_id="1" ]
05-28 08:59:31.852 10485 10690 I BugleE2eeMls: New MLS update to ConversationsTable? true. [CONTEXT conversation_id="1" ]

For conversation_id="2", it's not MLS-capable so it seems it's supposed to use another protocol (EncryptionProtocol(value=1)). But there's no success logs for that:

08:59:32.529 Checked standard MLS capabilities for 1 users. Result: false
08:59:32.529 Checked Bugle-specific MLS capabilities for 1 users. Result: false
08:59:32.529 Not all remote identities are MLS-capable. Non-MLS: [...]
...
08:59:32.561 Compose Constraints: Not encrypted. isSelfIdentityEncryptionEnabled=true, conversation.isEncrypted=false.

There are also repeated destination token update failures but there's not much detail about it in the log

08:59:32.420 Updating the destination token for the RCS conversation. [conversation_id="2"]
08:59:32.427 Setting the destination token for the one to one conversation. [conversation_id="2" destination_token="..."]
08:59:32.463 Updating the destination token for the RCS conversation. [conversation_id="2"]
08:59:32.487 Failed to update conversation with destination token. [conversation_id="2"]
08:59:32.491 Updating the destination token for the RCS conversation. [conversation_id="2"]
08:59:32.543 Failed to update conversation with destination token. [conversation_id="2"]
08:59:32.551 Failed to update conversation with destination token. [conversation_id="2"]

In Google Messages, go to the search bar and enter *xyzzy*. You should see a toast at the bottom popup saying Debug menu option enabled. The debug menu is located on main Google Messages screen > Tap on your avatar > Find Debug under More from the app section.

Try these steps first:

• Debug menu > Tachyon / Ditto > Refresh PhoneNum with Tachyon
• Force stop messages, reopen, confirm that RCS says it's connected in Google Messages settings
• Open up a conversation and wait

If that doesn't work, then we would need to try to include logging output from Google Messages to see if more info gets logged out.

If you have access to adb on a trusted computer with USB debugging in Developer options, then you can try to run this on computer

adb shell setprop log.tag.BugleConversation VERBOSE
adb shell setprop log.tag.BugleCME VERBOSE
adb shell setprop log.tag.BugleMapi VERBOSE
adb shell setprop log.tag.BugleE2ee VERBOSE
adb shell setprop log.tag.BugleE2eeEtouffee VERBOSE
adb shell setprop log.tag.BugleE2eeMls VERBOSE
adb shell setprop log.tag.TachygramNetworkCapabil VERBOSE
adb shell setprop log.tag.BugleTachygram VERBOSE
adb shell setprop log.tag.BugleRcsCapabilities VERBOSE
adb shell setprop log.tag.ProviderRcsCapabilities VERBOSE
adb shell setprop log.tag.BugleRecipients VERBOSE
adb shell setprop log.tag.BugleDataModel VERBOSE
adb shell setprop log.tag.BugleSimStateTracker VERBOSE
adb shell setprop log.tag.BugleRcsEngine VERBOSE
adb shell setprop log.tag.BugleSelfIdentity VERBOSE
adb shell setprop log.tag.BugleRcsProvisioning VERBOSE
adb shell setprop log.tag.BugleNetwork VERBOSE
adb shell setprop log.tag.Lighter VERBOSE
adb shell setprop log.tag.Bugle VERBOSE
adb shell setprop log.tag.WM-GreedyScheduler VERBOSE
adb shell setprop log.tag.WM-Processor VERBOSE
adb shell setprop log.tag.WM-WorkerWrapper VERBOSE
adb shell am force-stop com.google.android.apps.messaging

then re-capture Message logs and send to logs@grapheneos.org after trying to open a conversation and waiting