Security Model

We use the Veil Engine, a Rust-based cryptographic core that implements the Signal Protocol (Double Ratchet + X3DH).

Key Exchange

X3DH

Extended Triple Diffie-Hellman (Curve25519)

Encryption

AES-256-GCM

Authenticated Encryption with Associated Data

Forward Secrecy

Double Ratchet

Keys change with every single message.

Identity

Ed25519

Edwards-curve Digital Signature Algorithm

How a Message Travels

1. Encryption (On Device)

Alice types "Hello". Veil Engine generates a fresh Message Key from the ratchet chain. The message is encrypted with AES-256-GCM.

2. Transit (Blind Server)

The ciphertext is sent to the server. The server can only see:From: Alice,To: Bob, andTimestamp. It cannot see the content.

3. Decryption (On Device)

Bob receives the ciphertext. His Veil Engine derives the matching Message Key. If the MAC checks out, the message is decrypted. The key is then deleted from memory.