Threat Model
This page is the only source for TrueSeal’s security claims. Tell users nothing stronger than a row of the claims table, and state the limitations alongside it. Each claim names its tests at a pinned commit, and CI fails when one disappears.
Wording to use
TrueSeal is end-to-end encrypted. The relay can't read or forge messages, and here is exactly what it does see.
The relay never logs, stores or uses your IP address. The server it runs on still sees the connection, as with any internet service. To hide your IP from the server too, use a VPN or Tor.
Don’t describe the relay as unable to see IP addresses, and don’t call group membership hidden from the relay.
Adversaries
- A malicious relay
- Drops, delays, reorders, replays and injects messages, and reads everything it stores.
- A network observer
- Watches traffic between devices and the relay, passively or actively.
- An outsider who knows a device's public key
- Can push messages to that device's Inbox.
- A current member
- Fully trusted for membership changes. What a hostile one can do is listed under Not defended against.
- A removed or former member
- Still holds its old keys and everything it already received.
- A device thief
- Holds the device, and the keys and data on it.
Claims
Confidentiality
| Claim | Proved by |
|---|---|
| Only the device a message is addressed to can decrypt its body. sync ADR-0031 |
|
| After a device sees a member's removal, it sends that member nothing more and discards what the member sends. sync ADR-0027 |
|
| Destroy Group ends the group for every device that receives it. Each device that receives it passes the Destroy on to the members it knows about, deletes all group state, and starts over with a new identity. After that, no device that received it sends anything to any old device address, the stolen one included. sync ADR-0029 |
|
Integrity
| Claim | Proved by |
|---|---|
| A message is accepted only if a current member signed it. The relay can't modify, re-address or forge it. sync ADR-0031 |
|
| A joining device trusts only the group whose Pairing Token it scanned, and never accepts a Group Manifest it didn't ask for. sync ADR-0023 |
|
| A message reaches the handler at most once, even when a malicious relay delivers it again. sync ADR-0031, ADR-0034 Limit: the Replay Window, 60 days |
|
Availability
| Claim | Proved by |
|---|---|
| Each addressed device gets every message at least once, in the order its sender sent it, while the relay is honest and the message's lifetime hasn't passed. sync ADR-0026 |
|
Metadata privacy
| Claim | Proved by |
|---|---|
| Stored messages carry no sender identity and no lasting sender pseudonym. Two sends from one device share no value the relay can read, except the End-to-End Version, and the recipient key when both go to the same device. sync ADR-0031 |
|
| The relay never logs, stores or uses your IP address. relay ADR-0012 | |
| Outside dev mode the relay logs no client metadata. relay ADR-0012 |
|
Forward secrecy
| Claim | Proved by |
|---|---|
| Traffic between a device and the relay is encrypted, authenticates the relay, and is forward-secret against network observers. relay ADR-0002 |
|
Each test is named at its repo's commit below, and CI fails when one is missing.
Limitations
No forward secrecy end to end
- There is no end-to-end forward secrecy and no post-compromise security.
- A stolen device key decrypts every message ever addressed to that device, including any a malicious relay kept.
- Transport forward secrecy protects only against network observers.
Data at rest
- Keys and pending plaintext sit in the app's sandbox, protected only by the operating system.
- A thief with access to an unlocked device's files, or malware, gets them.
- Moving keys into Keychain or Keystore is planned after the preview.
What the relay sees
- Each device's key, and when it is online.
- Who receives a message, its size (up to 61,440 bytes (60 KiB) of Sync body) and its time.
- Which devices receive the same messages. A single send fans out to every group member in one connection, with matching sizes and timing, from the sender's network address, so a relay operator can infer which devices likely share a group (sync ADR-0024).
- Which End-to-End Version a device runs, from which messages it leaves unacknowledged (sync ADR-0022).
- Often, which device sent a message, by IP address or timing.
The relay never logs, stores or uses your IP address. The server it runs on still sees the connection, as with any internet service. To hide your IP from the server too, use a VPN or Tor.
Availability
- A relay can drop or delay any message.
- Anyone who knows a device's public key can use up that device's Inbox quota and delay its delivery. Quotas are kept per recipient, and the relay doesn't prevent this (relay ADR-0012).
- Any current or former member can trigger Destroy Group.
Membership
- Every current member is fully trusted for membership.
- A hostile current member can remove everyone else.
- A removed device that does not cooperate can still rewrite membership on devices that have not yet seen its removal.
- Neither is defended against. The response to a hostile or compromised device is Destroy Group.
What Destroy Group does not do
- It can't recover or erase anything the stolen device already received or stored.
- It can't force the stolen device to wipe itself.
- It doesn't reach a device that stays offline longer than the relay's message lifetime (30 days by default). That device keeps its old group until the user destroys or leaves it there too.
- It doesn't complete while your device can't reach the relay. Your device shows "destroying" until it can.
- Any current or former member can trigger it. That includes a stolen device, which can end your group, though that cuts it off from the group as well.
Pairing
- There is no SAS or fingerprint check (sync ADR-0023). The inviter's explicit admission is the only check.
- Anyone who photographs a Pairing Token can use it while the pairing window is open.
Relay key
- The relay key can't be rotated in the preview. Changing it breaks every client configuration (relay ADR-0012).
Message handler
- The library acknowledges a message only after the handler finishes, so the relay sees how long the handler takes.
- A handler that never finishes stalls delivery (sync ADR-0026).
Not independently audited
- TrueSeal is not independently audited. Every claim on this page names the tests that prove it instead (sync ADR-0033).
Not defended against
- Malware on a device, or a compromised operating system.
- A global passive adversary that watches the whole network.
- Network-level identity. Anyone who sees the connections can correlate IP addresses and timing.
- A hostile current member. Every current member is fully trusted for membership changes (sync ADR-0027).
Vocabulary
- End-to-end encrypted
- A message is encrypted on the sending device for the device it is addressed to, and only that device can decrypt it.
- Relay
- The server that holds sealed messages in each device's Inbox until the device collects them. It is untrusted for confidentiality and integrity, and trusted only for availability.
- Member
- A device in the Group Manifest of a Sync Group.
- Former member
- A device that was removed or left, or whose group was destroyed.
- Replay Window
- The age, 60 days, past which a device rejects a message as too old (sync ADR-0031).
- Destroy Group
- Ending a group on every device that receives the Destroy (sync ADR-0029).