1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
CHAT CRYPTOGRAPHY COMPATIBILITY PROBE
Experimental, local-only work on feature/private-chat. This is a
cryptographic compatibility test, not a messaging application. Do not use
it for private conversations or real identities. It creates temporary
identities in memory and discards them; it does not create user chat files.
Fixed encryption: RFC 9980 ML-KEM-1024 + X448, OpenPGP v6.
Tested signing: ML-DSA-87 + Ed448, OpenPGP v6.
Backend: Sequoia 2.4.2 with OpenSSL 3.6.5. No algorithm substitution or
vulnerability-advisory exception was used. The first checkpoint's Rust
backend is historical and no longer selected.
See ../../docs/CHAT-OPENSSL-MIGRATION.txt for the complete decision record,
pinned source hashes, build flags, capability boundaries, dependency-policy
exceptions, observed results, limitations, and reproduction commands.
../../docs/CHAT-SECURITY-REVIEW.txt records the original dependency findings.
../../docs/CHAT-DESIGN.txt describes the planned application.
QUICK CHECKS FROM THE STACK ROOT
cargo test --locked -p stack-chat-crypto
cargo run --locked -p stack-chat-crypto
sh infra/chat/build-openssl-wasi.sh
PLAYWRIGHT_BROWSERS_PATH="$PWD/.tools/browsers" node crates/chat-crypto/tests/browser.mjs
cargo stack check
Native checks require OpenSSL >=3.5 development files and libclang.
The cross-build script currently supports Linux x86_64 development hosts.
Browser tooling installation is documented in the migration record.
The harness serves only a blank document, a readable AGPL JavaScript WASI
bridge, and the new WASI binary on an ephemeral loopback port. It verifies
the actual OpenSSL backend, cryptographic round trips, tampering and invalid
credential rejection, repeated fresh instances, and failure without CSPRNG.
It checks for external requests and persistent browser application state.
The application itself, private chat-file envelope, and session workflow
remain unimplemented. LibreJS acceptance has not been tested; there is no
public chat page or compliance badge. The fixture password is public test
data, not a configured secret. No .env file or user private key is needed.
|
