Asagiri朝霧
How the encryption works
Everything you send is encrypted on your phone and decrypted only on the phones it is meant for. Our servers and relays pass along data they have no keys for.
| Part | How it is protected | Post-quantum |
|---|---|---|
| One-to-one messages | PQXDH key agreement (X25519 with ML-KEM-1024), then a Double Ratchet that mixes in a fresh ML-KEM-768 exchange on every chain; AES-256-GCM | Yes (hybrid) |
| Group messages | Sender-key chains (HMAC-SHA256, AES-256-GCM); the keys travel over the one-to-one channels; each message signed by its author | Keys travel post-quantum |
| Photos and files | A random AES-256-GCM key per file, sent inside the ratchet | Through the ratchet |
| Messages waiting for an offline phone | Sealed to the recipient with X25519 and ML-KEM-1024, AES-256-GCM; the sender is inside the box | Yes (hybrid) |
| Calls | WebRTC DTLS-SRTP, set up over the authenticated connection between the phones | Not yet |
| Connections | TLS 1.3 (with a hybrid post-quantum key exchange) or Noise | TLS: yes |
| Identity and signatures | Ed25519 | No |
| On your phone | An encrypted database (SQLCipher) with a key protected by Android's keystore | — |
| Backups | Argon2id (64 MiB) from your passphrase, then AES-256-GCM; passphrases must be long and hard to guess | As strong as the passphrase |
Making sure it's really them
Every conversation has a safety number. Compare it with your contact in person or over a call, or scan each other's QR code, and Asagiri marks the contact as verified. If their keys change — for example, after reinstalling — the app tells you, so you can check again. Usernames and phone numbers help people find each other, but the safety number is what proves who you're talking to.
Secret chats
Secret chats live only in your phone's memory, never in its database or backups, with messages that always disappear and screenshots blocked on your screen. They stay on the phone you started them on and never reach a linked computer or browser.
What Asagiri can't protect against
- A compromised phone. Malware or someone with your unlocked phone can see what you see. Use a screen lock and the app lock.
- The other person. Encryption protects messages on the way, not after they arrive: a recipient can photograph their screen, and a modified app could ignore screenshot blocking or delete requests.
- Metadata on the network. Our servers and relays see IP addresses and timing. A dishonest operator could try to link who talks to whom from them. You can route Asagiri through Tor with a SOCKS5 proxy (Settings › Privacy & security › Connect through a proxy) to hide your address.
- Calls are not post-quantum yet. They use DTLS-SRTP; a recording made today could be at risk from future quantum computers.
- The web app is served from a website, so whoever controls that website could change the page. The desktop and Android apps don't have that weakness.
Audit status
Independent security audits are still to come. We plan audits of the one-to-one protocol, group chats, file transfer, linked devices and the username directory, and will publish the results here. Strong building blocks are not the same as audited code, so we won't call Asagiri "unbreakable".
Report a vulnerability
If you find a security problem, please write to security@asagiri.top with what you found and how to reproduce it. Please give us a reasonable time to fix it before making it public.
- We will acknowledge your report within [3 business days].
- We won't take legal action against good-faith research that respects users' privacy and doesn't disrupt the service.
- We'll credit you when the fix is released, if you'd like.
[Optional: a PGP key fingerprint for encrypted reports]