Today, messaging applications are the most popular medium of communication over the Internet. As their use has grown, different security and privacy concerns have received the attention of users. Users consider what they send with others to be private, tamper-proof and secure without getting exposed to unintended entities. Furthermore, users are concerned whether their data is exposed if the service provider encounters any cyber attack. In this paper, we propose a Self-Sovereign Identity (SSI)-based End-to-End Encrypted Peer-to-Peer (E2EE P2P) chat system that does not rely on any specific provider, enhancing user privacy and security. The system leverages decentralized identifiers (DIDs) to establish secure communication channels using the DIDcomm (DID Communications) protocol, which ensures the privacy of user data. We also introduce a secure file sharing mechanism that ensures that all data, including messages, are stored solely on the user's device, further safeguarding user privacy. The system is developed following the Design Science Methodology, addressing probable threats and satisfying different functional and security requirements. The architecture and its implementation details are discussed with the subsequent use cases and protocol flow. Finally, we analyze different aspects of the system.
Key Agreement for Decentralized Secure Group Messaging with Strong Security Guarantees
Secure group messaging protocols, providing end-to-end encryption for group communication, need to handle mobile devices frequently being offline, group members being added or removed, and the possibility of device compromises during long-lived chat sessions. Existing work targets a centralized network model in which all messages are routed through a single server, which is trusted to provide a consistent total order on updates to the group state. In this paper we adapt secure group messaging for decentralized networks that have no central authority. Servers may still optionally be used, but they are trusted less. We define decentralized continuous group key agreement (DCGKA), a new cryptographic primitive encompassing the core of a decentralized secure group messaging protocol; we give a practical construction of a DCGKA protocol and prove its security; and we describe how to construct a full messaging protocol from DCGKA. In the face of device compromise our protocol achieves forward secrecy and post-compromise security. We evaluate the performance of a prototype implementation, and demonstrate that our protocol has practical efficiency.
Decentralized Identity Verification using Zero-Knowledge Proofs: A Privacy-Preserving Authentication Framework
In the contemporary online interaction, digital iden- tity is central, but most systems follow a centralized provider like Google or Facebook. Although convenient, these models pose ma- jor risks to data breach, surveillance, and single point of failure. The proposed paper proposes a privacy-sensitive decentralized identity verification system that uses Zero-Knowledge Proofs (ZKPs) to allow users to make it through claims (e.g., age, citizen- ship, or enrollment) without any personal data being provided, thereby solving the challenges outlined in the paper. Our architecture integrates verifiable credentials, zero-knowledge-SNARKs and an issuer trust registry that is maintained on blockchain smart contracts to guarantee trustless verification and eliminate dependence on centralized authorities. Its system gives its users full control over credentials, allows reuse across applications, and does not expose data.A proof-of-concept implementation has shown the approach to be feasible with Circom and SnarkJS to generate proof, Solidity smart contracts to verify them, and a user interface implemented in React. Results of the evaluations showed that determination of the verification latency is low, the overhead to generate proofs is moderate, and no privacy leakage occurs. It can be used in potential applications such as education, e-governance, healthcare, finance, and online voting.
I2P - The Invisible Internet Project | EN
I2P is a fully encrypted private network layer. Protect your online activity from surveillance and censorship with built-in end-to-end encryption.
Private Chat Backups with Local-First Principles
Introducing encrypted chat backups and multi-device syncing that extends our end-to-end privacy principles to persistent cloud storage.
BeeKEM: Decentralized, Secure and Efficient Group Key Agreement
Group key agreement protocols are essential for modern secure messaging. Most existing group key agreement protocols assume a centralized model with a semi-trusted service that mediates the communication. This is efficient, but problematic for some important applications, since a central service can be a choke point for surveillance and censorship. There is a nascent literature on decentralized group key agreement that avoids such reliance, but existing proposals either do not scale, with update costs linear or quadratic in the group size, or lack proofs of security. Centralized protocols can offer much lower (logarithmic) cost. We present BeeKEM, the first decentralized group key agreement protocol with logarithmic update cost in the common case (degrading to linear in the worst case) and proofs of security. We provide an open-source implementation and demonstrate that it is competitive with OpenMLS. BeeKEM opens the door for a range of communication and collaboration applications offering not only end-to-end encryption, but also metadata privacy and censorship resistance.
Investigation into Message Layer Security (MLS)
This article investigates Message Layer Security (MLS), the IETF standard protocol (RFC 9420) for Signal-style end-to-end encryption. Through a practical analysis of OpenMLS (the Rust reference implementation) and a demonstration CLI chat application (mls-chat), the post reveals the substantial gap between protocol specification and production deployment. Introduction MLS (Message Layer …
White Noise - Secure Private Messenger
A truly secure and private messenger that's lightning fast, massively scalable, and identity-free.
Making end-to-end encrypted AI chat feel like logging in
We want private AI chat to be simple. Yet today, many end-to-end encrypted experiences still have a level of friction that make them feel like they’re from another era: it usually either involves a long seed phrase users are asked to “store securely,” insecure password based encryption, or apps that aren’t cross-device and lose your data periodically (on reinstall, browser cache clear, etc).
SyRA: Sybil-Resilient Anonymous Signatures with Applications to Decentralized Identity
We study Sybil-Resilient Anonymous (SyRA) signatures, a cryptographic primitive that enables credentialed users to generate, on demand, unlinkable pseudonyms tied to any given context, and issue signatures on behalf of these pseudonyms. Concretely, SyRA allows a distributed issuer to turn any legacy identity or personhood identifier, possibly of low entropy, into a unique associated cryptographic key of high pseudoentropy, for use in generating signatures for any given context. Sybil-resilient anonymous signatures achieve three main objectives: 1) Sybil resilience: every user is entitled to at most one digital identity, 2) anonymity: no information about the user’s real identity is leaked, and 3) non-interactive context switching: users can create on their own at most one credential for any given context in a manner that is unlinkable across contexts. We conceptualize the SyRA primitive as an ideal functionality in the Universal Composition (UC) setting and put forth SASSI, an efficient, pairing-based construction that realizes it by utilizing two levels of verifiable random functions (VRFs), a design which may be of independent interest. The first level consists of threshold VRF issuance of a user’s unique secret key tied to their real-world identifier. The second level allows a user to create signatures for each context, under a unique pseudonym per context. Compared to prior cryptographic tools capable of realizing SyRA, SASSI has the unique feature that issuers are stateless and hence do not need to retain any information about past user interactions, a relevant property for a decentralized implementation. We overview various applications of SASSI in multiparty systems, such as cryptocurrency account management and airdrops, e-voting (e.g., for decentralized governance), and privacy-preserving regulatory compliance (e.g., AML/CFT checks). In the context of creating addresses for digital assets, SyRA signatures enable users to embed their legacy identity into their address in a manner that protects their privacy for each application with which they interact. We demonstrate the practicality of SASSI by providing an implementation and performance evaluation of our construction.
IACIS 2026 - OpenConf Abstract Submission, Peer Review, and Event Management System
As lawmakers across the United States move to require age verification for access to adult content online, new questions are emerging about the unintended risks these laws create. While intended to protect minors, many of these policies rely on systems that collect and store overly sensitive personal information such as government-issued IDs or biometric data without adequate safeguards. This introduces serious cybersecurity vulnerabilities, privacy concerns, and potential legal liability for platforms and users alike. Some major platforms have already withdrawn from certain states rather than comply, raising questions about the real-world feasibility of these laws. This study examines the intersection of digital privacy, cybersecurity, and legal compliance in the context of mandatory age verification. It analyzes the risks posed by identity-based and biometric systems, the role of third-party vendors, and the inconsistencies in how states define and enforce these requirements. The paper evaluates several age verification models and concludes that attribute-based verification systems that confirm age eligibility without revealing full identities offers the most secure and privacy-conscious path forward. The findings underscore a critical need for better-designed legislation that balances child protection with digital rights and security. This research provides targeted recommendations for policymakers, platform operators, and cybersecurity professionals, urging a shift toward transparent, accountable, and technically sound solutions before flawed systems become entrenched.
FEP-1042: Peer to Peer Fediverse Identities
Hey folks, we at [Distributed Press](https://distributed.press) have been working on making a bridge between peer to peer or "dweb" protocols and ActivityPub implementations over the past year and wanted to solidify our approach so that others can interoperate. Here's is an initial draft expla...
CCFS cryptographically curated file system
The Internet was originally designed to be a next-generation phone system that could withstand a Soviet attack. Today, we ask the Internet to perform tasks that no longer resemble phone calls in the face of threats that no longer resemble Soviet bombardment. However, we have come to rely on names that can be subverted at every level of the stack or simply be allowed to rot by their original creators. It is possible for us to build networks of content that serve the content distribution needs of today while withstanding the hostile environment that all modern systems face. This dissertation presents the Cryptographically Curated File System (CCFS), which offers five properties that we feel a modern content distribution system should provide. The first property is Strong Links, which maintains that only the owner of a link can change the content to which it points. The second property, Permissionless Distribution, allows anyone to become a curator without dependence on a naming or numbering authority. Third, Independent Validation arises from the fact that the object seeking affirmation need not choose the source of trust. Connectivity, the fourth property, allows any curator to delegate and curate the right to alter links. Each curator can delegate the control of a link and that designee can do the same, leaving a chain of trust from the original curator to the one who assigned the content. Lastly, with the property of Collective Confidence, trust does not need to come from a single source, but can instead be an aggregate affirmation. Since CCFS embodies all five of these properties, it can serve as the foundational technology for a more robust Web. CCFS can serve as the base of a web that performs the tasks of today’s Web, but also may outperform it. In the third chapter, we present a number of scenarios that demonstrate the capacity and potential of CCFS. The system can be used as a publication platform that has been re-optimized within the constraints of the modern Internet, but not the constraints of decades past. The curated links can still be organized into a hierarchical namespace (e.g., a Domain Naming System (DNS)) and de jure verifications (e.g., a Certificate Authority (CA) system), but also support social, professional, and reputational graphs. This data can be distributed, versioned, and archived more efficiently. Although communication systems were not designed for such a content-centric system, the combination of broadcasts and point-to-point communications are perfectly suited for scaling the distribution, while allowing communities to share the burdens of hosting and maintenance. CCFS even supports the privacy of friend-to-friend networks without sacrificing the ability to interoperate with the wider world. Finally, CCFS does all of this without damaging the ability to operate search engines or alert systems, providing a discovery mechanism, which is vital to a usable, useful web. To demonstrate the viability of this model, we built a research prototype. The results of these tests demonstrate that while the CCFS prototype is not ready to be used as a drop-in replacement for all file system use cases, the system is feasible. CCFS is fast enough to be usable and can be used to publish, version, archive, and search data. Even in this crude form, CCFS already demonstrates advantages over previous state-of-the-art systems. When the Internet was designed, there were relatively fewer computers that were far weaker than the computers we have now. They were largely connected to each other over reliable connections. When the Internet was first created, computing was expensive and propagation delay was negligible. Since then, the propagation delay has not improved on a Moore’s Law Curve. Now, latency has come to dominate all other costs of retrieving content; specifically, the propagation time has come to dominate the latency. In order to improve the latency, we are paying more for storage, processing, and bandwidth. The only way to improve propagation delay is to move the content closer to the destination. In order to have the content close to the demand, we store multiple copies and search multiple locations, thus trading off storage, bandwidth, and processing for lower propagation delay. The computing world should re-evaluate these trade-offs because the situation has changed. We need an Internet that is designed for the technologies used today, rather than the tools of the 20th century. CCFS, which regards the trade-off for lower propagation delay, will be better suited for 21st-century technologies. Although CCFS is not preferable in all situations, it can still offer tremendous value. Better robustness, performance, and democracy make CCFS a contribution to the field. Robustness comes from the cryptographic assurances provided by the five properties of CCFS. Performance comes from the locality of content. Democracy arises from the lack of a centralized authority that may grant the right of Free Speech only to those who espouse rhetoric compatible with their ideals. Combined, this model for a cryptographically secure, content-centric system provides a novel contribution to the state of communications technology and information security.
Secure Scuttlebutt
Secure Scuttlebutt (SSB) is a peer-to peer communication protocol, mesh network, and self-hosted social media ecosystem.[3][4] Each user hosts their own content and the content of the peers they follow, which provides fault tolerance and eventual consistency.[5] Messages are digitally signed and added to an append-only list of messages published by an author.[6] SSB is primarily used for implementing distributed social networks, and utilizes cryptography to assure that content remains unforged as it is propagated through the network.[7][8]
ATSMS — end-to-end encrypted group messaging
Encrypted group messaging on AT Protocol identities, with no server ordering anything.
Integrating Germ with AT Protocol — Germ Network
End-to-end encrypted Germ DM is now a Bluesky messenger. In this technical post, we introduce the architecture of Germ’s integration with AT Protocol. From the beginning, Germ has been building for an interoperable E2EE ecosystem, and this extends to our integration with AT Protocol. We’ll define th
