Brief summary of key security and performance aspects
The xx messenger unlinks sender and recipient data and protects against traffic-analysis attacks that undermine many other privacy approaches found in onion routing, proxies, and other mixnets. All messages are routed through a decentralized batch mixnet managed by a blockchain. Five node teams are randomly assembled and assigned to process a batch every third second, all of which would need to be compromised in order to break sender-receiver unlinkability. You can read more about this process from our What is cMix? wiki page.
Each message in the xx messenger is encrypted with XChaCha20 symmetric encryption. The encryption is quantum secured by using encryption keys derived from a combination of a Supersingular Isogeny Diffie–Helman (SIDH) 3024 bit algorithm for post-quantum key exchange and the classic Diffie–Helman (DH) 3072 bit algorithm. The xx messenger also provides forward secrecy and post-compromise security with a periodic re-keying mechanism in a process sometimes known as ratcheting.
A full explanation of End-to-End encryption, with links to relevant source code, is available on our wiki here: End-to-End Encrypted Messaging in xx Messenger.
Notice – 7/30/2022: SIDH has been found to be vulnerable conventionally as of 7/30/2022. Details can be found here. The team is working on a fix.
We use a 256 bit keyed hash message authentication code, HMAC-SHA256 in the xx messenger.
Users can choose to build out their profile by adding and registering their email address or phone number. We use Twilio, a third-party service, to complete the verification process over e-mail or phone with SMS messages. Once the user confirms their verification code, a salted hash (256 bit Blake2b) of their email or phone number is stored in the database. The xx messenger protects users’ personal information and never stores unencrypted plain text on any servers.
Users can choose to use only their unique username through user discovery. They can also directly use QR codes to bypass the User Discovery service entirely.
A full description of User discovery is available on the wiki: User Discovery
We use android or IOS firebase when the mobile app is closed. However, not all messages are real, thereby obscuring who gets which notifications. You can read more about our privacy preserving notifications system here on our wiki: ID Collisions and Notifications
Typically, messages sent with xx messenger travel through the network in a few seconds. You can see which teams are processing messages and how fast they process them at the dashboard: https://dashboard.xx.network
We use 256 bit XChaCha20 symmetric encryption with a key derived from a password provided by the user for backups.
xx Foundation does not distribute, offer, solicit sales of, or sell any xx coins in any state or jurisdiction in which such a distribution, offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
Copyright © 2022 xx Foundation
