Threat model / architecture / evidence
Security, with explicit boundaries.
This page separates implemented controls, current verification evidence, and known limits. M2 does not claim perfect anonymity, untraceability, immunity from compromise, or completion of an independent audit.
01 / Threat model
The relay should not need plaintext to deliver a message.
The primary objective is to keep message and attachment plaintext, Signal private material, and decryption keys out of the Gateway, database, object storage, and Cloudflare release layers. Those systems process encrypted payloads and limited routing, timing, and retention metadata.
M2 still uses servers for asynchronous delivery. The security claim is not that servers do not exist; it is that delivery infrastructure is not designed to possess the content keys required to read the conversation.
02 / Security boundary
Plaintext becomes ciphertext on the Android endpoint.
Messages
Channel-scoped Signal state provides end-to-end encrypted message transport. Each Channel separates member identity, mailbox, invitation capability, Signal identity and session state, and ACK signing material.
Attachments
Each file uses a random 32-byte key and 12-byte nonce for AES-256-GCM streaming encryption. File name, MIME type, key, nonce, and digest are carried inside the E2EE envelope; private object storage receives opaque ciphertext.
Local state
Flutter and native Signal data are stored in Vault-specific SQLCipher databases. Database keys are wrapped by non-exportable Android Keystore AES-GCM keys; ACK private keys remain in non-exportable Android Keystore Ed25519 keys.
03 / Compartmented identity
No phone number, email address, or global user profile.
A display name exists inside a Channel, but M2 does not create a central account that naturally links identities across every Channel. Local aliases can change how another member appears on one device without rewriting that member’s own Channel name.
Generic FCM wake introduces installation-level metadata when Android notifications are allowed: Google and push infrastructure can observe an app installation token and wake-delivery events. FCM does not carry Channel IDs, message IDs, senders, previews, or attachment metadata.
04 / Onion transport
Tor is transport infrastructure, not a browsing feature.
- Production accepts an approved
.onionendpoint. - The SOCKS path preserves unresolved hostnames to avoid local DNS resolution.
- The Gateway application listener is bound behind the persistent v3 Onion Service.
- When Tor or the Gateway is unavailable, messages remain in the local queue.
- Production does not silently retry against a clearnet API.
05 / Relay retention
A durable local commit is the start of relay deletion.
- The receiving device obtains and decrypts ciphertext.
- Message or file state is durably committed to encrypted local storage.
- The device sends an ACK signed for the recipient mailbox and ciphertext digest.
- The Gateway verifies the signature, recipient, and digest.
- Database and object-ciphertext deletion begins; a limited idempotency tombstone may remain temporarily.
Undelivered ciphertext is configured to expire from server-received time after a maximum of 48 hours. The exact production configuration and deletion paths have been checked; a 48-hour wall-clock wait has not been recorded for this release.
06 / Device controls
Controls continue inside the endpoint.
Single Passcode
One ordinary Passcode gates SQLCipher and Android Keystore-wrapped state. Existing Primary credentials are promoted; legacy Secondary data can be merged once only after its legacy credential is verified.
No destructive passcode
Format and Immediate Delete credentials and passcode-triggered wipe have been removed. A legacy destructive credential cannot erase application data.
Screen capture
Normal screenshots, screen recording, and recent-app previews are intentionally available in v0.5.12. This is a product setting, not a cryptographic control. Protected files still suppress in-app Share and Download, but an authorized or compromised endpoint can reproduce visible content.
Protected files
Requires original-sender approval before a protected file can be viewed in M2. Export and sharing remain disabled after approval.
07 / Verification status
Current release gates are verified by scope.
| Area | Current evidence | Status |
|---|---|---|
| Signed release | arm64 APK, Universal APK, AAB, SHA-256, signer continuity | PASS |
| Static and unit checks | Flutter, Go, Worker, and security scans | PASS |
| Staging messaging E2E | Android ARM64 AVD clients, message/attachment ACK, voice-memo READY/position/ENDED, locked and Doze wake, and accelerated TTL | PASS |
| Wake coalescing | Ten constant data wakes, one unique worker, one Tor ACTIVE generation, full drain, durable commit before local notification | PASS |
| B-v1 production | Separated APP/DB, TLS verify-full, retention, encrypted backup/restore, load, production ACK smoke and rollback boundary | PASS |
| Attack paths | Replay, unsigned and forged ACK, quota, Tor fail-closed, DNS-leak prevention | PASS |
| Physical devices | Affected-device update without uninstall/data clear and independent second-device regression on the final build | NOT RUN |
| Independent audit | Third-party security assessment | PENDING |
Public release evidence
08 / Known limitations
What the current design does not protect.
- Rooted, infected, or maliciously administered endpoints
- External cameras and recipients who copy or retransmit plaintext
- Counterparties who present a false real-world identity
- Advanced traffic-correlation by a global observer
- Installation-level metadata when Android permits generic FCM wake
- Commercial availability guarantees beyond the documented two-node B-v1 production architecture and its tested capacity envelope
- Unbounded large-group scale
Google Play publication, an independent security audit, complete dependency-license review, and independently reviewed libsignal corresponding-source compliance remain pending. The exact M2 source archive, component inventory, and third-party notice are public release artifacts; they do not claim that the pending reviews are complete.