From bb5ac5b1d094ef80a23f850159391a4b16b54d15 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Sousa=20Andrade?= <659718+joaosa@users.noreply.github.com> Date: Sat, 9 May 2026 16:16:27 +0100 Subject: [PATCH] Fix relay encryption docs (#849) --- docs/architecture.md | 2 +- packages/website/src/routes/privacy.tsx | 5 +++-- public-docs/security.md | 7 ++++--- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/architecture.md b/docs/architecture.md index 7cf7962f0..74911998b 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -103,7 +103,7 @@ Communicates with the daemon via the same WebSocket protocol as the app. Enables remote access when the daemon is behind a firewall. -- ECDH key exchange + AES-256-GCM encryption +- Curve25519 ECDH key exchange + XSalsa20-Poly1305 (NaCl `box`) encryption - Relay server is zero-knowledge — it routes encrypted bytes, cannot read content - Client and daemon channels with identical API (`createClientChannel`, `createDaemonChannel`) - Pairing via QR code transfers the daemon's public key to the client diff --git a/packages/website/src/routes/privacy.tsx b/packages/website/src/routes/privacy.tsx index 2cfbc7162..2032d52e5 100644 --- a/packages/website/src/routes/privacy.tsx +++ b/packages/website/src/routes/privacy.tsx @@ -40,8 +40,9 @@ function Privacy() {
  • Session IDs

    • - All messages between your phone and daemon are end-to-end encrypted with AES-256-GCM. - The relay cannot read your messages, see your code, or decrypt your traffic. + All messages between your phone and daemon are end-to-end encrypted with + XSalsa20-Poly1305. The relay cannot read your messages, see your code, or decrypt your + traffic.

    diff --git a/public-docs/security.md b/public-docs/security.md index 178406586..fefaf88d9 100644 --- a/public-docs/security.md +++ b/public-docs/security.md @@ -31,7 +31,8 @@ The relay is the simplest way to connect from your phone. It requires no VPN set 1. The daemon generates a persistent ECDH keypair and stores it in `$PASEO_HOME/daemon-keypair.json` 2. When you scan the QR code or click the pairing link, your phone receives the daemon's public key 3. Your phone sends a handshake message with its own public key. The daemon will not accept any commands until this handshake completes. -4. Both sides perform an ECDH key exchange to derive a shared secret. All subsequent messages are encrypted with AES-256-GCM. +4. Both sides perform a Curve25519 ECDH key exchange to derive a shared key. All subsequent + messages are encrypted with XSalsa20-Poly1305 (NaCl `box`). The relay sees only: IP addresses, timing, message sizes, and session IDs. It cannot read message contents, forge messages, or derive encryption keys from observing the handshake. @@ -40,8 +41,8 @@ The relay sees only: IP addresses, timing, message sizes, and session IDs. It ca The daemon requires a valid cryptographic handshake before processing any commands. A compromised relay cannot: - **Send commands**, Without your phone's private key, it cannot complete the handshake -- **Read your traffic**, All messages are encrypted with AES-256-GCM after the handshake -- **Forge messages**, GCM provides authenticated encryption; tampered messages are rejected +- **Read your traffic**, All messages are encrypted with XSalsa20-Poly1305 (NaCl `box`) after the handshake +- **Forge messages**, NaCl `box` provides authenticated encryption; tampered messages are rejected - **Replay old messages**, Each session derives fresh encryption keys ### Trust model