lockbitchat
5f22b7dab5
The invitation carried the whole session: both public keys, their signatures, a salt, a challenge and the full SDP. It now carries only what brings up DTLS — ICE credentials, the certificate fingerprint, candidates, an expiry — plus a 16-byte commitment to the key material. The key material itself moves to the DataChannel and is checked against that commitment before it is parsed. Measured on the live site: 2274 characters across 4 animated QR frames became 151 characters in a single frame. The safety code is now computed over a transcript of both descriptors and both key blobs, and the HKDF salt is derived from that same transcript instead of being transmitted. authProof is replaced by one signature over it. SBQ2_SEND_ENABLED is the single value that reverts new invitations to SB1.
Documentation
Technical documentation for SecureBit.chat. Start with the project README if you are looking for an overview or a quick start.
| Document | What it covers |
|---|---|
| ARCHITECTURE.md | How a session is established, verified and torn down, and where each guarantee comes from |
| CRYPTOGRAPHY.md | Key schedule, the Double Ratchet, SAS verification, memory handling |
| CONFIGURATION.md | Deployment, ICE and TURN setup, privacy modes, file transfer policy |
| CALLS.md | Voice and video: codec choices, adaptation, and why each value was picked |
| API.md | Internal interfaces of the WebRTC manager and file transfer system |
| CONTRIBUTING.md | Development workflow and what needs extra review |
| USE-POLICY.md | Terms of use, intended use, and the limits of what the software can protect |
Security policy and vulnerability reporting live in SECURITY.md at the repository root, where GitHub expects to find them.
Keeping this accurate
These documents describe the current release and are expected to change with it. Every value quoted here (limits, timeouts, algorithm parameters) is taken from the source rather than restated from memory, so if you change one in code, change it here in the same commit. CONTRIBUTING.md lists which documents are affected by which areas of the code.