Encrypted messaging web app design I’m implementing an encrypted messaging web app using JS. When composing a message, the user is provided with the public key of the recipients. A body field is also rendered for every recipient. After the user clicks submit, the original message is encrypted with the recipients’ public keys, which is then inserted into their respective body fields.

Since every user has their own body field (the ciphertext varies between users), a malicious user could write a different message for every recipient. How should I go about tackling this problem?
Include sender and receiver in the plaintext message (you need some kind of message format for that) and also sign the message (including sender / receiver) before encryption. That way an attacker cannot alter or swap the plaintext message. You may also need to assign the message a number of include some kind of timestamp to avoid replay attacks.

You could encrypt the message first using a message key and encrypt that key using the various public keys of the receivers. Note that the encryption scheme should not fall to plaintext / padding oracle attacks, as the signature should be over the plaintext, not the ciphertext.