Device Identity
Your user has a phone and a laptop, both in the same group. To TrueSeal they are two members, each with its own identity, and TrueSeal doesn’t know they belong to the same person. A device’s identity is two keypairs it generated itself, and nothing else.
Two keypairs
| Keypair | Algorithm | What it’s for |
|---|---|---|
| Encryption | X25519 | Other members seal messages to its public key. It is also the device’s address on the relay. |
| Signing | Ed25519 | The device signs every message it sends. The member’s id and name come from this key. |
The library generates both on first use and keeps them in Session State. The library never sends the private keys anywhere. The public keys go to every member in the Group Manifest, and the relay sees the encryption key as the address of the device’s Inbox.
No account
No server registers a device or hands out IDs. A device that hasn’t paired exists only on itself. The relay learns its encryption key once the device opens a Receive Session or someone sends to it. It gets no name or account with the key.
Your app sees each member as a Member with an id and a name. me is this device, and members lists every other member. The name is a two-word label derived from the signing key, such as SwiftFox. Show it, but don’t use it to decide who to trust, because anyone can generate keys until their name matches a real device’s.
When the identity changes
A device keeps its identity across restarts, crashes and app updates. It gets a new one, and loses its group with the old one, in four cases:
- another member removes it;
- it leaves the group;
- it destroys the group, or receives a Destroy Group from another member;
- an upgrade can’t migrate its Session State, and the library resets the store.
Each time, the library wipes the namespace, generates new keypairs and reports statusChanged(notJoined, reason), with removed, left, destroyed or storeReset as the reason. Your TrueSeal object stays usable and can pair again. To the other devices it is then a new device, with a new id.
What stays your app’s job
- Mapping devices to people. One person with three devices is three members.
- Telling the user that a lost device can’t be recovered. TrueSeal keeps no backup of the keys and has no way to move them to a new device; the new device pairs as a new member.
- Labelling devices if two-word names aren’t enough, inside your own messages.
Where the keys are kept
In the preview, the keys sit in Session State protected only by file permissions and, where the platform has one, the app sandbox. They aren’t in the Keychain or Keystore, and the database isn’t encrypted. Both are required before 1.0. Developer preview lists what the preview does and doesn’t promise.