6 · The cryptography & the code
The long-horizon and the supply-chain risks.
The math is chosen to survive quantum computers. Two honest caveats remain:
one place secrets touch the wire, and the question of whether the client you run is the client we wrote.
An introduced channel, recorded, versus a future ML-KEM break
Harvest-now, decrypt-later
How it works. A channel you got by introduction had its
secrets cross the wire once, sealed with post-quantum ML-KEM-768. A QR-scanned channel never did.
If ML-KEM-768 were broken decades from now, a recording of that one introduction packet could expose
that channel’s history (1-to-1 has no ratchet, so it’s the whole channel).
Surface: recorded E2E payload
Who: an adversary who records now and breaks PQ crypto later
Residual & what you do. The trust colours are this
hierarchy: green = never on the wire, blue/red = on the wire once. Verify introduced contacts in
person; it rotates their secrets into the QR class and closes the window. For the most sensitive
relationships, meet and green-verify from the start.
A backdoored client — including a hostile PWA host
Supply chain
How it works. The strongest crypto is void if the app running
it is malicious. The web client is served as static files by some host — if you load a PWA
from a server you don’t control, that host could ship a backdoored client that leaks your keys, and
you’d never see it. The same logic that makes self-hosting the server matter applies to the client.
Surface: the client build
Who: whoever ships you the app
Residual & what you do. Prefer the native app’s
reproducible, signed builds from a pinned toolchain. If you use the PWA, host it yourself from the
published source — the same static files you can read. Don’t run a security client from a party you
wouldn’t trust with your keys, because that’s what running it is.
A broken platform RNG
Foundational
How it works. Keys, nonces, and secrets all come from the
operating system’s cryptographic random generator. If that RNG is backdoored or badly broken,
generated secrets could be predictable — a failure beneath every cipher choice.
Surface: the OS CSPRNG
Who: a platform-level adversary
Residual & what you do. Cutout uses only the platform
CSPRNG (no home-grown randomness) and 192-bit nonces so no counter state can be corrupted. Beyond
that, this is trust in your OS — run one you have reason to trust.
“Aliens” — a break of symmetric crypto itself
Out of model, stated anyway
How it works. If XChaCha20-Poly1305 or SHA-256 were
fundamentally broken — not just weakened by quantum search — the confidentiality of everything falls.
This is outside the threat model, which already assumes “aliens with infinite resources” only in the
sense of quantum computers.
Surface: mathematics
Who: nobody known to exist
Residual & what you do. Symmetric crypto faces only Grover,
not Shor — 256-bit keys keep ~128-bit effective strength against quantum search. There is no action to
take; it is here so the list is complete and honest.