1.2 Groups & Channels
Group names, avatars, and every word sealed end-to-end.
Groups and channels with names, subjects, and content end-to-end encrypted — the relay holds opaque routing identifiers — plus owner-signed admin rights, channel-scoped identities, and an eight-member routing floor as the anonymity baseline.
- FIPS 203
- FIPS 204
- Key distribution ML-KEM-1024
- Per-message signature ML-DSA-87
- Sender-key ratchet HKDF-SHA-512
- AEAD ChaCha20-Poly1305
01 / THE ROOM — SIX STATES
Step through the room, state by state.
Each member holds a 32-byte sender key that ratchets forward via HKDF on every message — labels QERYX_SENDER_KEY_RATCHET_v1 and QERYX_SENDER_MSG_KEY_v1 — with a post-quantum rotation every 100 messages.
One key per voice, one seal per message. The room never shares a single secret everyone could leak.
Every membership change forces a rotation. The fresh sender key is encapsulated to each remaining member as one ML-KEM-1024 ciphertext — and never to the member who left.
Remove someone and the next key is born without them. A quantum adversary holding their old state gains nothing forward.
A new member receives sender keys at the join index only. Messages before the join were sealed under keys that are never re-distributed.
History is unrecoverable by design — the room does not owe its past to its future.
The owner role signs the rights matrix: which admin may invite, remove, or post, and the ban list beneath it. Rights arrive signed, not asserted.
An admin change you did not sign is an admin change that did not happen.
Inside a channel you are a channel-scoped identity: CSID = HKDF(identity_secret, channel_id). Your Profile ID lives in 1:1 conversations only.
Two channels cannot correlate you — each derives a different you.
Routing fan-out never presents a group smaller than eight to the relay. Small rooms borrow the crowd of a larger one.
Eight is the anonymity baseline, not the membership requirement.
02 / THE GROUP SEAL — LETTERED
Read the group seal, section by section.
Sender keys, hardened
Every member speaks under their own 32-byte sender key. It ratchets forward per message via HKDF and rotates on a post-quantum epoch — the shipped construction is hardened sender keys with forced rotation, stated as exactly that.
- Ratchet labels
- QERYX_SENDER_KEY_RATCHET_v1 · QERYX_SENDER_MSG_KEY_v1
- PQ rotation
- every 100 messages
- Source
- SenderKeyService.swift · SPEC/07 §9.2
Distribution and rotation
A sender key travels to each member as its own ML-KEM-1024 encapsulation, signed under ML-DSA-87. Membership change forces rotation: the fresh key is never encapsulated to the removed member, so their view of the room ends at the moment they left — quantum adversary included.
- Per member
- one ML-KEM-1024 ct (~1.5 KiB)
- Signature
- ML-DSA-87 · ctx QERYX-msg-v1
- Source
- SPEC/07 §9.4–9.5
Every message signed
Each group message carries its author's ML-DSA-87 signature. A stolen sender key cannot forge in your name — the identity secret is a separate key that never enters the room. Stronger than per-recipient authentication, and cheaper than trust.
- Forgery requires
- your ML-DSA-87 identity secret — a leaked group key is not enough
- Skip window
- 200 keys per (channel, sender) · zeroized on consume or evict
- Source
- SPEC/07 §9.7
Who you are in a channel
Channels never see your Profile ID. You appear as a channel-scoped identity derived one-way from your identity secret and the channel — two channels derive two different values, and neither walks back to the first.
- CSID
HKDF(identity_secret, channel_id)- Profile ID
- 1:1 conversations only
The honest cost
Rotation is real work and we publish the math: at one hundred members, a full rotation moves about 600 KiB of ML-KEM ciphertexts and signatures — amortized to roughly 6 KiB per message. Groups that rotate on every removal pay for the property they get.
- Full rotation @ 100 members
- ~600 KiB · amortized ~6 KiB/message
- Source
- SPEC/07 §9.12
What groups do not defend
A current member leaking plaintext, and out-of-band screenshots. No group construction defends member discipline — we say so because a page that will not say so cannot be trusted on the rest.
Remove a member and the next key is born without them.
Admin power arrives signed
The owner signs the per-admin rights matrix and the ban list. An unsigned rights change is rejected, not debated — governance is a cryptographic object, the same class as a message.
Group names, subjects, avatars, and all content are end-to-end encrypted; the relay holds only opaque routing identifiers.
03 / THE GROUP MATH — FOOTNOTED
Check the group math against the spec that fixes it.
1 ct1
fresh ML-KEM-1024 ciphertext per member on every rotation
1002
messages per post-quantum rotation epoch
83
members — the smallest fan-out the relay is ever shown
| Parameter | Value | Source |
|---|---|---|
| Sender key | 32 B per member, HKDF ratchet per message | SenderKeyService.swift |
| PQ rotation | every 100 messages | SPEC/07 §9.2 |
| Distribution | one ML-KEM-1024 ct per member (~1.5 KiB) | SPEC/07 §9.4 |
| Message signature | ML-DSA-87, ctx QERYX-msg-v1 | SPEC/07 §9.4 |
| Skip window | 200 keys per channel and sender | SPEC/07 §9.9 |
| Routing floor | 8-member minimum fan-out | SPEC/07 |
| Group calls | per-stream sender keys, rotation on ejection | SPEC/07 §9.11 |
04 / THE VERDICT — CATEGORY COLUMNS
Set a QERYX room against the two categories it replaces.
| QERYX | Classical E2E | SMS-tier | |
|---|---|---|---|
| Real workloads | |||
| Member removed | Forced key rotation — the future is sealed to them | Often deferred to the next epoch, or none | No encryption at all |
| Group metadata under subpoena | Encrypted names and avatars; opaque routing identifiers | Plaintext group names and member lists are common | Full membership at the carrier |
| Traffic recorded today, decrypted later | ML-KEM-1024 rotation forecloses it | Classical sender keys readable later | Readable now |
| Impersonation inside the group | Per-message ML-DSA-87 signature | MAC-only — any key holder can forge | Spoofable sender |
| History for new joiners | Never — past keys are not re-distributed | Configurable; often shared | Full history on device swap |
05 / THE HARD QUESTIONS
Ask what the relay learns about the room.
Can the server list who is in my group?
Group names, subjects, avatars, and all content are end-to-end encrypted; the relay holds only opaque routing identifiers; sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time. Undelivered messages queue with routing metadata under a published retention ladder.
What does a removed member still see?
Everything up to their removal; nothing after. The next sender key is never encapsulated to them.
Can a new member scroll back?
No. Past sender keys are never re-distributed.
Can someone forge a message in my name?
Forgery requires your ML-DSA-87 identity secret. A leaked group key is not enough — signing keys never enter the room.
What can be handed over under subpoena?
Opaque sender-key blobs, ciphertext in transit, and routing identifiers under the retention ladder. Reading content requires breaking both X25519 and ML-KEM-1024.
What is the eight-member floor?
Routing fan-out never presents a group smaller than eight to the relay — the anonymity baseline for small rooms, not a membership minimum.
What don't groups defend against?
A current member leaking plaintext, and out-of-band screenshots. No group construction defends member discipline.