Copyright (C) 2026 Doan Luu Duc Tai This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. You should have received a copy of the GNU Affero General Public License along with this program. If not, see . OPENSSL BACKEND MIGRATION RECORD Date: 2026-10-30. Branch: feature/private-chat. Scope: a compatibility and dependency-security experiment, not a messenger. Main and production are unchanged. No real identity files are created. DECISION AND FIXED ALGORITHMS Retain Sequoia OpenPGP 2.4.2 and RFC 9980 ML-KEM-1024 + X448 encryption. Retain ML-DSA-87 + Ed448 signatures, OpenPGP v6 keys, and AES-256 content encryption. Change the cryptographic backend, not the algorithms or wire protocol. Probe assertions reject an unexpected backend or key algorithms. The previous Rust backend reached cx448 0.1.1 -> crypto-bigint 0.5.5 during curve arithmetic. It also included rsa 0.9.10. See CHAT-SECURITY-REVIEW.txt for the original reachability investigation. Neither RustSec issue was ignored. No mathematical implementation was patched locally. The current manifest enables only Sequoia's crypto-openssl feature. The allow-experimental-crypto and allow-variable-time-crypto opt-ins are gone. The resolved graph has no cx448, crypto-bigint, or rsa crate. This removes those Rust backend dependencies; it does not prove that all side channels are absent from a browser or that external C dependencies have no defects. VERSIONS AND SOURCE PROVENANCE Rust toolchain: 1.99.1, pinned in rust-toolchain.toml. Sequoia OpenPGP: 2.4.2, exact requirement and Cargo.lock. OpenSSL: 3.6.5, native host library and source-built static WASI libraries. WASI SDK: 34.0 x86_64 Linux, bundled Clang/libclang 23.1.0-wasi-sdk. Browser test runner: Playwright 1.64.1, Chromium 156.0.8078.4. SDK archive: https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-34/wasi-sdk-34.0-x86_64-linux.tar.gz SHA-256 b761e3a0721dbae9c09a0059e5fdb2bf917d1b4a8a7b430fb3b5aafb0984b2c4 OpenSSL archive: https://github.com/openssl/openssl/releases/download/openssl-3.6.5/openssl-3.6.5.tar.gz SHA-256 a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 Digests were checked against upstream GitHub release asset metadata. The build script verifies each archive before extraction. Hash checking pins these inputs; it is not a claim that upstream release signatures were independently verified or that output is bit-for-bit reproducible across hosts. Archives, SDK, libraries, and build products stay under ignored .tools/ and target/. The native development library is supplied by the OS. WHY WASI The original Rust-backend proof used wasm32-unknown-unknown and generated wasm-bindgen JavaScript. The OpenSSL proof uses a wasm32-wasip1 command module and a small explicit browser WASI bridge. The Rust command calls the same compatibility_probe function used by native tests. The browser harness loads the new WASI binary directly, not old generated glue. It requires the output to identify OpenSSL 3.6.5, preventing a stale Rust-backend artifact from being accepted as evidence of OpenSSL support. Old browser-build commands are historical and must not be reused here. BUILD CONFIGURATION AND BOUNDARIES infra/chat/openssl-wasi.conf adds a build target inheriting BASE_unix with little-endian and 32-bit bignum configuration. It changes configuration, not OpenSSL's cryptographic source routines. C code is compiled at -O2. No third-party rand.patch, unconditional entropy-success patch, or custom random-number generator is applied. A SHA-256 comparison of all 5889 original regular files against the downloaded OpenSSL archive found no changed or missing originals after the build; only the separate target configuration was added. OpenSSL 3.6.5 already supports WASI getentropy in providers/implementations/rands/seeding/rand_unix.c. Configure selects --with-rand-seed=getrandom. WASI libc's entropy request reaches wasi_snapshot_preview1.random_get. The browser bridge services it exclusively through crypto.getRandomValues, splitting requests at 65536 bytes. There is no Math.random, fixed seed, or success-on-failure fallback. The negative test replaces that API with a failure and requires rejection. Build options disable assembly, async operations, automatic config loading, DSO/modules, POSIX I/O, secure-memory arenas, shared libraries, sockets, C stdio, thread pools, threads, and interactive console UI. They avoid unsupported host capabilities and use static libraries. Disabling the secure-memory arena means ordinary WASM linear memory is used; it does not establish secure erasure, locked pages, or protection from delivered JS. Disabling C stdio does not disable the Rust command's captured output. _WASI_EMULATED_GETPID and libwasi-emulated-getpid supply the SDK's process-ID emulation. getuid/geteuid/getgid/getegid map to getpagesize, following the common WASI port configuration: the browser module has no real OS user IDs or privilege boundary. These values are not used as randomness or identity credentials. This is an explicit portability assumption, not a general POSIX security emulation layer. Rust bindings use the SDK's libclang and WASI sysroot with target wasm32-wasip1 and -fvisibility=default. Without explicit visibility, the initial bindgen attempt omitted function declarations. Rust's bundled WASI libc search path precedes the SDK libraries: reversing that order initially failed to link __wasi_init_tp. The SDK library path remains available for the emulated-getpid archive. These failures were toolchain integration issues; no generated cryptographic bindings were manually edited. BROWSER CAPABILITIES The WASI bridge supplies clocks, browser CSPRNG, empty arguments/environment, EOF on stdin, and bounded in-memory stdout/stderr for this closed test. It supplies no real files, preopened directories, sockets, or process launch. Listed filesystem/network operations return NOTCAPABLE or BADF. Unknown imports fail before instantiation. Standard output is capped at 65536 chars. Those capability denials protect against accidentally connecting the WASI module to host storage or networking. They do not isolate it from malicious JavaScript delivered by the same server. Memory, clocks, randomness, and imported bridge functions remain part of the trusted browser environment. A test deadline closes Chromium after 120 seconds if execution stalls. VERIFICATION Native: the same probe passes using OpenSSL 3.6.5. It checks v6 generation, exact algorithm selection, protected-secret-key serialization/import, signed UTF-8 encryption to both participants, decryption by each, wrong password rejection, unexpected signer rejection, and ciphertext tampering. Browser: actual Chromium executes the OpenSSL WASI binary and passes the same checks, then repeats with a fresh module instance. One observed normal execution requested 1792 bytes across 72 browser CSPRNG calls. These counts are observations, not cryptographic requirements or entropy estimates. Removing secure randomness causes failure rather than a successful result. A modified module requesting an unknown host import is also rejected before instantiation. These negative tests require the expected failure reason. The harness also observes no external requests, cookies, localStorage, sessionStorage, IndexedDB databases, or service-worker registrations. Its HTTP responses carry Cache-Control: no-store. This establishes only this probe's behavior, not that browsers/OSes cannot retain memory, caches, crash dumps, swap, or restored state. A complete chat session does not exist. The native tests, WASI build, and browser test are separate checks. A native pass cannot stand in for browser execution. A functional pass and a clean vulnerability scan cannot stand in for a cryptographic or side-channel audit. DEPENDENCY POLICY REVIEW The RustSec database reports no advisories for the current resolved graph. No advisory ignore was added. Bans on wildcards, unknown Git/registry sources, and unreviewed duplicate versions remain enabled. The following existing upstream API generations cannot be unified merely by cargo update. Duplicate exceptions match only the exact older version; other versions remain subject to the duplicate ban. All these packages still undergo advisory and license checks. Cargo.lock pins both sides of each pair. block-buffer 0.10.4 vs 0.12.1 crypto-common 0.1.7 vs 0.2.2 digest 0.10.7 vs 0.11.3 Sequoia's Argon2 0.5.3 -> BLAKE2 0.10 uses the older digest API. Root SHA-256 and the parser generator's SHA3 use the newer API. cpufeatures 0.2.17 vs 0.3.1 Argon2 uses 0.2; root SHA-256 and parser-generator SHA3 use 0.3. generic-array 0.14.7 vs 1.4.5 Argon2/BLAKE2 digest uses 0.14; SHA1 collision detection uses 1.x. getrandom 0.2.17 vs 0.4.3 Sequoia's unknown-unknown WASM target dependencies declare 0.2; the root CLI's tempfile uses 0.4. The current browser target is WASI, whose OpenSSL entropy source is the bridge described above. The all-target graph is still audited rather than excluding that edge. hashbrown 0.15.5 vs 0.17.1 petgraph uses 0.15 directly and indexmap 2.14 uses 0.17. Both are brought in by the parser generator at build time. itertools 0.13.0 vs 0.15.0 shlex 1.3.0 vs 2.0.1 bindgen uses older APIs; lalrpop and cc require the newer ones. These are build dependencies, not a justification to skip auditing. syn 2.0.119 vs 3.0.9 bindgen/prettyplease and Windows support use syn 2. Root derive macros and other dependencies use syn 3. Changing that would require upstream migration or unrelated dependency downgrades. The only new license allowance is ISC, scoped to libloading, a bindgen/clang dependency. GNU-compatible third-party licenses remain correctly attributed. cargo-about generates notices for the complete workspace. The static OpenSSL C library and SDK are not Rust crates; their original licenses and sources must accompany any distributed browser artifact as appropriate. Source OpenSSL LICENSE.txt is Apache-2.0. Do not treat the Rust notice page alone as complete documentation of external C/toolchain distribution obligations. EXTERNAL LIBRARY MAINTENANCE cargo-deny does not audit the externally built OpenSSL C archive or SDK. Review OpenSSL's release/advisory pages separately and rebuild when needed: https://openssl-library.org/news/timeline/ https://openssl-library.org/news/vulnerabilities-3.6/ OpenSSL 3.6.5 is the tested security-patch release dated 2026-09-29. A green Rust audit is not a lifetime security guarantee for this pinned C version. Choose and document a supported update policy before production deployment. REPRODUCE FROM THE STACK ROOT Native prerequisites: OpenSSL >=3.5 development headers/library, libclang, pkg-config, and the pinned Rust toolchain. For the cross build also provide a Linux x86_64 build host, Perl, make, curl, tar, and sha256sum. No root-owned packages or system settings are changed by the cross-build script. cargo test --locked -p stack-chat-crypto cargo run --locked -p stack-chat-crypto sh infra/chat/build-openssl-wasi.sh npm install --prefix .tools/browser --save-exact playwright@1.64.1 PLAYWRIGHT_BROWSERS_PATH="$PWD/.tools/browsers" .tools/browser/node_modules/.bin/playwright install chromium PLAYWRIGHT_BROWSERS_PATH="$PWD/.tools/browsers" node crates/chat-crypto/tests/browser.mjs cargo stack check The build script pins archive versions and hashes, configures static OpenSSL, installs it under .tools/openssl-wasi, builds the Rust WASI command, and prints its SHA-256. It does not download/use an unverified precompiled OpenSSL binary. It may reuse already extracted sources; use a fresh ignored tools/build tree when independently verifying the source archive rather than trusting a previously modified extraction. Downloads and test artifacts are not secrets. Build logs and complete dependency trees are local ignored diagnostics in .tools/chat-openssl-*.log and .tools/chat-openssl-duplicates.txt. The native result and the browser result must explicitly identify the OpenSSL backend. REMAINING WORK Observed WASI artifact SHA-256 on this development machine: 7fba6b96377619ef41f056d4027c4409107372e9300b2dd69be865e72892df79 This is a diagnostic identifier, not a cross-host reproducibility promise. This removes the specific Rust-backend dependency blocker and demonstrates the fixed algorithms in a browser. It is not a complete messaging service, audit of OpenSSL/WASI/JIT timing behavior, LibreJS certification, or proof against malicious delivery. The file format, authentication, server/database, quotas, hostile-input handling, pagination/counts, backup recovery, complete session lifecycle, and browser-state tests still need implementation.