Generate
The Rust engine generates the Ed25519 identity key on first launch. Private keys never reach Dart (ADR-005).
SECURITY MODEL · Verifiable, not promised
Security
Maturity ladder and threat table. Until an independent audit ships, this site shows no audit badges or fake PDFs (ADR-010).
Handshake
What happens inside one handshake
No session key exists until all four steps pass. Any failure aborts the connection.
- 01
Discover
mDNS or a scanned code yields a candidate. A candidate carries no identity claim and is never trusted.
- 02
Key exchange
Exchange ephemeral X25519 keys and sign the whole handshake transcript with the Ed25519 identity key.
- 03
Mutual confirm
Both sides compare the same short SAS digits and confirm. Any mismatch aborts — no half-trusted state.
- 04
Session crypto
HKDF-SHA256 derives AES-256-GCM session keys. Long-term keys only sign, never enter the KDF.
Key lifecycle
The life of a key
Identity and session keys are strictly separated: one only signs, the other is thrown away.
Store
Handed to platform secure storage: Keychain / DPAPI / Android Keystore. Export fails by design.
Sign
Long-term keys only sign the handshake transcript; they never feed key derivation.
Session
Each connection derives fresh keys from ephemeral X25519 + HKDF-SHA256, discarded when it ends.
Revoke
Device ids derive from public keys, so revocation is per device and leaves other pairings intact.
Threats
Threats, defenses, residual risk
The third column is what we cannot do. Writing it down beats hiding it.
| Threat | Defense | Residual |
|---|---|---|
| LAN sniffing | App-layer AES-256-GCM | Compromised endpoint still sees plaintext |
| Spoofed discovery | Signed QR payload + mutual SAS | Social engineering on the human |
| Untrusted file send | Engine rejects the FileOffer | Malware arriving from a trusted peer |
| Relay peek | E2EE; relay off by default | Relay still sees metadata (timing / size) |
| Replay & tamper | AEAD on every frame + protocolised nonce + counters | Implementation bugs (we can be wrong too) |
| Supply chain | Published SHA-256 + platform signature notes | Fails if the build pipeline is compromised |
Maturity
Maturity ladder
Progress is self-assessed, not a third-party verdict.
Threat model & static review
In progress
Protocol tamper / replay tests
Core paths covered
Third-party audit
Not started — no badges until done
Ongoing disclosure & patch SLA
Process draft
Limits
What we cannot do
These do not expire with time — they are model boundaries, not a backlog.
A controlled endpoint beats us
If a device is fully owned, plaintext is readable at that end. Every E2EE scheme stops there.
You can confirm wrongly
SAS exists so you can compare, not so we can decide for you. Being talked into confirming is handing over trust.
Relay sees metadata
The relay never learns content, but it does learn who sent how much, when.
No badges before an audit
ADR-010: until an independent audit ships, this site shows no audit badges and no fake PDFs.
Disclosure
Target: acknowledge within 72 hours. Send reproducible details to security@.
Install first, decide later
The client runs Local by default. Read the security model in two minutes if you prefer.