softdeadlock/voron-crypto

Voron crypto is the encryption and messaging protocol core of a small end to end encrypted messenger project, published on its own to ask outside developers to review it for security problems. It does not include the phone app or deployment setup, only the underlying cryptography and protocol code. The library builds one to one private conversations using an asynchronous key agreement method similar to the Signal protocol's X3DH, followed by a Double Ratchet that keeps rotating encryption keys as messages are exchanged, so that even if a key is later exposed, past and future messages stay protected. These pieces are built on well established primitives like Curve25519, ChaCha20-Poly1305, Ed25519, and HKDF, rather than custom cryptography at that lower level. Group conversations use a simpler sender-keys scheme, the approach early WhatsApp and Signal groups used, plus a signed hash chain log that records membership and role changes on the client side, since the relay server has no built in concept of groups. There is also an optional onion style transport that sends messages through a fixed number of encrypted hops and pads them to consistent sizes, so a relay only sees one hop of a conversation and cannot easily link a connection's network address to the identity behind it. The project states plainly that this does not protect against an attacker watching both ends of a conversation at once, since that would require cover traffic that has not been built. The relay server is intentionally minimal and treated as untrusted: it forwards encrypted messages and public key material without ever seeing plaintext, and is assumed to potentially be actively hostile. A folder of prior internal security review write ups is included, along with working proof of concept exploits for bugs already found and fixed, and reviewers are asked to check that folder first before reporting something that may already be documented. The authors are upfront that no independent professional security audit has been done. All existing review is by the project's own contributors, presented as a starting point for outside review, not a certification. It is a Kotlin project built with Gradle, requiring JDK 17 or newer to run its test suite.