Security — QERYX

CNSA 2.0 — scoped conformance

CNSA 2.0 — asymmetric core conformant (ML-KEM-1024 + ML-DSA-87 at Category V; SHA-512 at or above the hash floor). Production AEAD today is ChaCha20-Poly1305 (RFC 8439), a documented deviation; the AES-256-GCM NSS suite is implemented and reserved as suite 0x0002, staged for rollout. Pre-evaluation checklist: 0 non-conformant findings, 3 documented deviations (NIAP ETR, 2026-05).

01Threat model — six adversaries

Name your adversary. Read what stands against it.

Tap an adversary. Each answer names the module and the primitive that stands against it — and states what that module does not do.

State signals intelligence

Every session runs a hybrid key exchange: X25519 and ML-KEM-1024 combined through HKDF-SHA-512, so recording traffic today does not buy decryption by a future quantum computer. Q-Ratchet rotates keys per message; a captured key opens nothing before or after it.

Endpoint compromise

Forward secrecy bounds the blast radius: keys already ratcheted away cannot be recovered from a seized device. Local vault material is derived with Argon2id at m=512 MiB, t=2, p=4 and held in the platform secure enclave. A compromised endpoint still reads what its user can read — no protocol prevents that, and we do not claim one does.

Legal compulsion

The operator holds ciphertext and opaque routing identifiers — the full inventory is the ledger below. There is no key-escrow and no master reset, so there is no key to compel. Breaking a session requires breaking both X25519 and ML-KEM-1024.

Traffic analysis

Sender identifiers are blinded per delivery token and hourly window; payload sizes snap to fixed padding buckets (64 B to 16 KiB for text) so length stops being a fingerprint. QLEAP routes through three hops when you turn it on. Timing correlation by a global passive observer remains an open problem for every messenger, including this one.

Supply chain

Every release publishes a build-attestation manifest signed with ML-DSA-87 (ctx QERYX-attest-v1); the update-authenticity trust-root registry is not yet claimed. ML-KEM and ML-DSA dispatch to a library lineage holding FIPS 140-3 cert #4631 — QERYX’s own module is not yet CMVP-certified.

Physical seizure of the server

The exhibit below is the complete answer: sealed ciphertext, blinded identifiers, and a queue with a stated retention period. The plaintext rows are listed too — honesty about the residue is part of the design.

02The ledger — the carrier schema, field by field

Read the whole inventory the relay holds.

This is the real carrier schema — the fields the relay holds for a message in flight, stamped with what each one yields to anyone who takes the machine.

Mixcōātl carrier ledger — one queued message

ciphertext Your message, sealed with ChaCha20-Poly1305 under keys that exist only on the two devices. Ciphertext
sender_blinded_pid Sender identifier committed under the delivery token and hour window — reversible only by the recipient (sealed-sender v2, rolling out). Opaque
recipient_blinded_pid Recipient commitment the relay matches against pre-registered device windows to route the envelope. Opaque
delivery_token Per-conversation routing token. Rotates on every key-transparency append. Opaque
ciphertext_hash SHA-512/256 over the body, bound by an ML-DSA-87 delivery proof — the relay cannot rewrite what it carries. Opaque
time_window_id The hour window the blinded commitments were minted under. An integer, visible. Plaintext
created_at Queue timestamp for undelivered messages. Visible while the message waits. Plaintext
group metadata Group names, subjects, avatars, and all content are end-to-end encrypted; the relay holds only opaque routing identifiers. Ciphertext

Sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time. Undelivered messages queue with routing metadata under a published retention period — 30 days today¹, with a shorter tiered ladder on the roadmap. The plaintext rows above are the whole residue; nothing else is held back.

03Seizure — the disk image at T+0

Seize the relay. Open the disk image.

Exhibit — relay disk image, T+0

Delivered messages: gone. Online delivery relays through memory and the row is erased on acknowledgment.

Undelivered messages: sealed ciphertext plus the ledger rows above, held at most 30 days¹ before the hourly purge job deletes them.

Attachments: QSEAL-Stream chunks — fixed 256 KiB sealed blocks whose total size snaps to a padding bucket. Keys travel inside the message ciphertext, never to the server.

Keys: none. There is no key-escrow and no master reset. Breaking a session requires breaking both X25519 and ML-KEM-1024.

04Verify — SHA3-256 in your browser

Derive a safety number with your own hands.

This is the same 24-hex-character format the app derives for every pairing — computed here with real SHA3-256, in your browser, from an authored demo transcript. Rotate the demo session and watch the number change.

KTS · SAFETY NUMBERSHA3-256 WASM · LOADING

One number on two screens.

Your device and your peer’s each derive it from the session. If they match, your keys agree end to end — an interceptor cannot show you the same number.

YOUR DEVICE

0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF-0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF

Your safety number: BF4B-945F-A4B5-7A1E-D4D9-7C20

In the app: Q-Ratchet root key + both peers’ ML-DSA-87 public keys → HKDF-SHA512 → 16 bytes; the short form renders 12 of them as six groups of four hex characters.^{KTS-QUORUM SPEC}

In the shipped app, key transparency rides a 2-of-3 multi-witness quorum (verify-only today — operator equivocation is detected, not prevented) plus three external Ed25519 auditor slots that ship dormant: all three hold placeholder keys, so no external cosignature is carried yet. Registry expansion is release-gated by design.

05Go deeper — nine surfaces

Take the next surface. Nine of them are open.

06Safe harbor — research, authorized in writing

Test us in good faith. This clause covers you.

Security research on QERYX conducted in good faith is authorized. If you make a good-faith effort to follow the disclosure policy — test only against your own accounts, avoid degrading service for others, do not access or retain another person’s data, and report promptly to security@qeryx.com — QERYX Inc. will not initiate legal action against you for that research and will not refer it for prosecution. Where a third party raises a claim, we will state on record that your research was authorized. This clause is published policy pending final counsel review; the disclosure mechanics live at /security/disclosure.

07The record — the questions we get asked hardest

The hard questions.

Can QERYX read my messages?

No. The server is a dumb encrypted blob relay. Message keys are born and die on the two devices; the operator holds the ledger above and nothing else. The zero-knowledge page walks the whole path.

What happens if you are subpoenaed?

We can produce only what the ledger holds: sealed ciphertext, blinded identifiers, and queue timestamps for messages not yet delivered. Breaking a session requires breaking both X25519 and ML-KEM-1024.

Can you recover my account if I lose everything?

We cannot recover your messages or your account if you lose your device and your Secret Phrase. There is no key-escrow and no master reset.

Is any of this independently checked?

Five core primitives carry machine-checked Verifpal proofs — 5 of 5 PASS with non-vacuous negative controls¹ — and the NIAP pre-evaluation ETR (2026-05) is published with its three deviations enumerated. Artifacts live under transparency.

Next: Post-Quantum — keys built to outlast the recording