06 Technology
Read the whole stack from its own source.
Every layer, every primitive, every formula — printed from the source, with the standard each one answers to.
01The stack — six layers yours, two ours
Six layers on your device. Two on ours.
Device · Applications
One SERPENT-ID across the ecosystem — the messenger first, the rest as they arrive
Messenger · QMail · QVault · QWallet · QLEAP · Wadjet · HydraSIM · Qaduceus
Identity + Trust
Who you are, provable — never disclosed
SERPENT ID (secret) · Profile ID (public) · KTS-Quorum key transparency · ML-DSA-87 signatures
Voice · Video · Media
Calls fail closed, media seals in chunks
EVS-PQ binder · Q-Manifest · EVM-Pad · QSEAL-Stream (256 KiB chunks)
The EVS-PQ binder was previously labeled EVS-DTLS-PQ. Its dtls_master_secret slot is fed from the same hybrid X25519 + ML-KEM-1024 handshake secret as its KEM slot, domain-separated by HKDF label — there is no DTLS layer, so the two slots share upstream entropy rather than being independent. The HKDF label below keeps its original spelling because it is a wire-visible domain separator.
crypto-core (Rust, one library, every platform)
The primitives live in one place
ML-KEM-1024 · ML-DSA-87 · X25519 · ChaCha20-Poly1305 · HKDF-SHA-512 · Argon2id · Q-Ratchet · Q-KEM-Trinity · Q-GroupCipher
Entropy base layer
Where keys are born
Server-relayed entropy pool, conditioned as defense in depth and folded into group sender-key roots — never into a one-to-one message key + deterministic dual-peer CHSH ritual; the operator-signed QPU transcript lane (v2) is designed and not active on any deployment
Carrier · Relay + Mixcōātl ledger
A pure relay that stores only opaque envelopes
Rust/Axum relay · erase-on-ack · sealed-sender routing · sovereign bare metal, no hyperscaler dependencies
02Primitives — ten, each with its standard
Check every primitive against its standard.
| Symbol | Primitive | Standard | Key facts |
|---|---|---|---|
| KEM | ML-KEM-1024 | FIPS 203 | 1568 B public key, 32 B shared secret |
| SIG | ML-DSA-87 | FIPS 204 | 2592 B public key, 4627 B signature |
| DH | X25519 | RFC 7748 | 32 B keys, classical hybrid half |
| AEAD | ChaCha20-Poly1305 | RFC 8439 | 256-bit key, 96-bit nonce, 128-bit tag; key-committing mode on by default |
| AEAD-2 | AES-256-GCM | FIPS 197 + SP 800-38D | implemented, reserved as suite 0x0002 |
| HASH | SHA-512 | FIPS 180-4 | 64 B digest — the CNSA hash floor |
| HASH-3 | SHAKE-256 / SHA3-256 | FIPS 202 | transcripts, Bell ritual, domain separation |
| KDF | HKDF-SHA-512 | RFC 5869 | every derived key, under a registered QERYX- label; the legacy framing places label and context back to back with no separator — a documented deviation from the SP 800-108 fixed-input convention, frozen on the wire, every existing slot machine-checked collision-free; new slots carry an explicit delimiter |
| PWKDF | Argon2id | RFC 9106 | vault floor m=128 MiB, t=3, p=4, device-calibrated upward; relay m=64 MiB, t=3, p=4; local backup m=256 MiB, t=4, p=2; 32 B output |
| MAC | HMAC-SHA-256 | RFC 2104 | presence and blind tokens, 16 B truncated |
CNSA 2.0 — asymmetric core conformant (ML-KEM-1024 + ML-DSA-87 at Category V; SHA-512 at or above the hash floor). The AEAD is ChaCha20-Poly1305 (RFC 8439), a documented deviation; the AES-256-GCM NSS suite is implemented and reserved as suite 0x0002. Pre-evaluation checklist (internal self-assessment against the NIAP Common Criteria bar, latest pass 2026-06): 0 algorithm-layer non-conformances, 5 documented deviations; no accredited-laboratory evaluation has begun.
03Formulas — verbatim from crypto-core
Read the formulas as the source prints them.
These are the doc blocks of the Rust source, character for character.
Hybrid.Encapsulate(pk_C, pk_PQ): // default v2 combiner
(ct_C, ss_C) ← X25519.Encapsulate(pk_C)
(ct_PQ, ss_PQ) ← ML-KEM-1024.Encapsulate(pk_PQ)
ss_hybrid = HKDF-SHA512(
IKM: ss_PQ || ss_C, // FIPS-approved component first
salt: "QERYX-HYBRID-v2-ML-KEM-1024-X25519", // fixed literal, not the ciphertexts
info: pk_C || ct_PQ || "QERYX-HYBRID-NIST-SP-800-227-v2",
len: 32
)
return (ct_C || ct_PQ, ss_hybrid)Verbatim from crypto-core. X-Wing-style concatenation over HKDF-SHA-512 — we do not claim the X-Wing IND-CCA2 proof at the -1024 parameter set.
srtp_master_key = HKDF-Expand(
prk = HKDF-Extract(
salt = call_id_bytes,
ikm = dtls_master_secret
|| ml_kem_shared
|| ml_dsa_pub_first
|| ml_dsa_pub_second),
info = "QERYX-EVS-DTLS-PQ-SRTP-v1",
L = 32)Verbatim from crypto-core. The binder has no fallback path: if the ML-KEM decapsulation fails, the derived keys differ and media halts on the first authentication tag.
Why print formulas instead of describing them?
Because a description can drift from the code and a printed doc block cannot drift far: it is reviewed against the source it lives in. Where a figure on this site is ever a simplification, it is stamped “simplified schematic” — an unstamped formula here is source text.
04Touch it — real ChaCha20-Poly1305
Seal something yourself. Then break it.
Real ChaCha20-Poly1305 in your browser: write a message, seal it, flip a byte and watch the tag refuse. The AEAD saying no is the whole lesson.
Real ChaCha20-Poly1305 (RFC 8439), compiled from Rust to WebAssembly, running in your browser. Same primitive family as the QERYX protocol; demo build, not the crypto-core module itself.
05Numbers — every one footnoted to its method
Recompute every number on this page.
6111
registered QERYX- domain-separation labels, uniqueness machine-enforced
623 B1
canonical v1 Bell transcript, spec-pinned length
1600 B1
hybrid public key and ciphertext on the wire — X25519 plus ML-KEM-1024
5 / 51
core primitives with machine-checked Verifpal proofs, negative controls included
The proven set, by name: Q-Ratchet, Q-KEM-Trinity, Q-GroupCipher, Q-Anamorph, Q-Threshold — 5 of 5 PASS. Five further Q-Entangle-Bell models exist as source; their verification outputs publish with the next revision. Two primitives additionally carry negative-control models that fail on purpose when the attacker is upgraded past the claim, proving the passes are non-vacuous. Artifacts at /security/transparency.
06The record — the questions we get asked hardest
The hard questions.
Why one Rust library instead of per-platform crypto?
Because parity bugs are key bugs. iOS, Android, and the backend call the same crypto-core through FFI; the label registry and its cross-platform tests are the contract that Swift and Rust hash identical bytes.
Why ChaCha20-Poly1305 and not AES?
Constant-time on every phone without hardware dispatch — and it is a documented CNSA deviation, stated in the conformance paragraph wherever we make the CNSA claim. AES-256-GCM is implemented and reserved as suite 0x0002.
Where does the entropy actually come from?
The platform CSPRNG. The relay separately conditions a pool from remote quantum-entropy providers — three are wired, and each refill's attestation names which answered — plus one local slot that falls back to the OS RNG; every refill records the name of each source that contributed and the reason any source was rejected. That pool is folded into group sender-key roots as defense in depth — it never replaces a device's own randomness, and it does not enter a one-to-one message key.