Keys never leave the phone
Created on the device and staying there. The server does not have them - so it cannot hand them to anyone.
How it works
The server passes the envelope on, it does not read it
So the words above can be checked instead of believed. Below - the same thing as one picture.
The server gets an envelope
Bytes, size, time and a queue address. The sender's name sits inside the ciphertext, but the server still knows who is sending: you send with your account's token. Hiding that too (Sealed Sender) is planned.
0:14
Photo · view once
Contract.pdf2.4 MB
this is what the server seesb6·f3·0e·9a·41·c7·2d
7c·02·d9·4b·a6·13·f0·8e
c4·5d·ee·19·70·ab·3f·d2
7c·02·d9·4b·a6·13·f0·8e
c4·5d·ee·19·70·ab·3f·d2
Post-quantum handshake
PQXDH: X25519 together with ML-KEM-1024. What is recorded today will not be opened by a computer that does not exist yet.
A key for every message
Double Ratchet: one stolen key opens neither the messages before it nor the ones after.
Twelve words instead of a password
The only way back in. The backup on the server is encrypted with them - we cannot open it.
An envelope lives 30 days
A delivered one is erased at once, an undelivered one after 30 days, attachments after 14.
KeysCreated on the phone and never leaving it. The server does not hold them, so it cannot hand them to anyone.
EnvelopeBytes, a queue address, a size and a time. The sender's name is inside the ciphertext, but you send with your own token, so the server knows who writes to whom. Hiding the sender is planned.
NotificationsThe server sends an empty «something new» signal: it does not know the text. Your phone fills it in after decrypting.
Encryption
What it is encrypted with - and what we did not write ourselves
Cryptography is not something a startup should invent. Tysha runs on libsignal - the same library Signal uses, reviewed by independent cryptographers for years.
libsignal, unmodified
Pinned by version and checksum. We did not write it and did not rewrite it - we only built it in.
Post-quantum handshake
PQXDH: X25519 together with ML-KEM-1024 in every handshake. A test in the build measures the real key size.
A key per message
Double Ratchet: one stolen key opens neither earlier messages nor later ones.
Post-quantum ratchet
SPQR (Triple Ratchet) on iPhone and iPad: post-quantum key updates after the handshake too. Not yet verified on other platforms.
Safety number
60 digits or a QR code, compared in person. If a contact's key changes, sending stops until you verify again.
A key per file
Attachments are encrypted with AES-256-GCM and a random key that travels inside the encrypted message.
Server
What is on our server - and what is not
The server carries envelopes and keeps the minimum delivery needs. Here is everything worth knowing, in the same words as on the Privacy page.
Where it runs
The server and the call relay are in the EU.
What is in the database
Username, notification token, queue address, public keys for introductions, the encrypted account backup. No message text, no encryption keys.
It knows who writes to whom
The sender's name is not on the envelope, but the server sees which account sent it to which queue. That is how delivery works.
How long things live
A delivered envelope is erased at once, an undelivered one after 30 days, files after 14, an invite code after 15 minutes.
Logs
No IP addresses, names or request bodies. The exception is the relay log with IPs: three 10 MB files that overwrite themselves.
No database backups
What is erased does not come back from a backup - there is none. Your account backup is encrypted with your 12 words, which we do not have.
Genuine on both ends
The app proves to the server it is genuine (App Attest) and checks the server's certificate - neither side can be swapped.
Status in public
Whether everything works is shown on a separate status page outside our infrastructure: status.202ok.online/status/tysha.
Server code is closed
App code on request (AGPL), server code - no. So the server's limits are described in words and checked by the audit.
Threat model
What it protects against - and what it does not
Protects
- Interception on the network: only ciphertext travels
- A breached server: there is no content on it
- Being found by number or name - there is no search
- Your IP in a call - the other side sees the relay
- A stranger on an unlocked phone - Face ID on chats and wipe
Does not protect
- A contact who forwards or photographs the screen with another phone
- Malware on your phone with system rights
- Someone who knows your unlock code and holds the phone
Next
What we harden next
An honest limit today is not a limit forever. Here is the plan, in order.
Uniform envelope size
Padding to multiples of 256 bytes, so size reveals neither the kind of envelope nor the length of the text.
External audit and bug bounty
The scope is written, the auditor is being chosen. After that, a reward for anyone who finds a vulnerability.
Reproducible builds
So anyone can check that the store build was made from exactly the code we hand out.