KEM Reddit Mentions | ChartExchange

I've been building **Neutrino**, an end-to-end encrypted messenger that runs entirely in the browser, and I'd like the design and code picked apart by people who actually know this stuff. Non-commercial solo project. Goal: trust the server as little as technically possible — no account, no phone number, no email.
* Live: [https://neutrino-chat.org](https://neutrino-chat.org)
* In-browser source viewer (per-file SHA-256): [https://neutrino-chat.org/code](https://neutrino-chat.org/code)
**Honesty first.** Not professionally audited (I ran an LLM-assisted self-audit — disclosed at the bottom per rule 8 — which is why I can list the weaknesses below, but it is not a substitute for human review).
**Stack — primitives from audited libs, protocol logic hand-written**
All primitives come from Paul Miller's @noble libraries (no libsignal, no libsodium):
* X25519 + Ed25519 — `@noble/curves`
* ML-KEM-768 (FIPS 203) — `@noble/post-quantum` (pure JS, no WASM)
* SHA-256 / HKDF / HMAC / PBKDF2 — `@noble/hashes`
* BIP-39 — `@scure/bip39`
* AES-256-GCM — WebCrypto (`crypto.subtle`), non-extractable keys
* RNG — `crypto.getRandomValues`
X3DH, the Double Ratchet and SPAKE2 are written by me on top of those. The \~460-line hand-rolled Double Ratchet and the self-written SPAKE2 are the two places I most expect — and want — scrutiny.
**How it fits together**
*Identity from the seed.* 12-word BIP-39 mnemonic (128-bit entropy; used purely as standardized key-encoding — nothing currency-related) → 512-bit seed (PBKDF2-HMAC-SHA512, 2048 rounds) → HKDF-SHA256 master key with domain labels → Ed25519 (signing) + X25519 (DH) identity keys. No BIP-32/SLIP-0010. Routing ID = SHA-256(Ed25519 signing pubkey): deterministic, **long-term and stable, never rotates** — so it's a per-user handle the relay can link across sessions and devices (deliberate: it's how contacts reach you and how backups are addressed).
*Pairing — two methods with different trust models (this matters):*
* **Rendezvous phrase (SPAKE2): TOFU-free.** Both sides run balanced SPAKE2 (RFC-9382-*style*, over ristretto255) with a shared out-of-band phrase. The full prekey-bundle hash (identity keys, signed prekey, ML-KEM pubkey, signature) is bound into the SPAKE2 transcript and confirmation MACs, so both parties prove they share the phrase *and* agree on each other's identity keys before X3DH is bootstrapped.
* **6-char one-time ID: NOT TOFU-free.** It's only a relay-side routing lookup — nothing cryptographically binds the code to the creator's identity, so a malicious relay could substitute a routing ID. It relies on out-of-band safety-number comparison to catch a MitM. The two methods are not equivalent and I say so in-app.
*Session.* X3DH, 3-DH (DH1=IK\_A·SPK\_B, DH2=EK\_A·IK\_B, DH3=EK\_A·SPK\_B). **No one-time prekeys currently** (the OPK path is dead code), so the first message has weaker forward secrecy than full X3DH until the first ratchet round-trip. PQ is added as a **two-stage hybrid (PQXDH-*****style*****, not Signal's PQXDH):** classical = HKDF-SHA256(F‖DH1‖DH2‖DH3); then ML-KEM-768 encapsulation against a signed ML-KEM prekey; final = HKDF-SHA256(X25519\_ss‖MLKEM\_ss). The ML-KEM prekey is signed by the Ed25519 identity (bundle signature covers SPK‖ML-KEM-pubkey), so it's identity-bound. It binds both secrets functionally, but it is *not* the spec construction (which mixes the KEM secret into the same KDF input as the DHs).
*Messaging.* Double Ratchet: HMAC-SHA256 symmetric chains, X25519 DH ratchet, HKDF-SHA256 root KDF, skipped-key cap 100. **No header-encryption variant** — the ratchet header (DH pubkey + counters) travels in clear and is used as AES-GCM AAD, so the relay sees ratchet pubkeys and message counters.
*Payloads.* AES-256-GCM, random 96-bit nonce, fresh per encryption. Safe because every message uses a unique one-time message key derived from the chain → no nonce reuse under a key.
**What the relay actually sees and stores** (correcting overclaiming I'd made elsewhere)
It's a blind relay for *content* — it only ever holds E2E ciphertext — but "stores nothing" would be false:
* Messages: RAM, destroy-on-read, 24h TTL (per-recipient + global caps). Online delivery is a direct forward with no ACK/presence oracle.
* Prekey bundles: RAM, 7 days.
* Encrypted backups: **on disk, up to 90 days** (below).
* Routing-ID registry (`accounts.json`): **on disk** — a monotonic list of every routing ID that has ever authenticated (drives a landing-page counter).
* Visible metadata: stable sender/recipient routing IDs (i.e. the social graph), online status, timing and padded sizes, ratchet headers; source IP is used for rate-limiting only, not logged. TLS terminates at Caddy, which proxies to a localhost-bound Node process.
**Encrypted backup.** AES-256-GCM, key = HKDF-SHA256(masterKey, "neutrino-backup-v1"), derived from the seed and domain-separated; padded to fixed buckets; server is blind to contents. **But it's currently on by default, server-side, retained up to 90 days, with no opt-out short of account wipe.** Confidentiality holds (server-blind); the "RAM-only" story does not — making it opt-in is an open decision.
**Client hardening.** RAM-only client: no localStorage/IndexedDB, **no service worker**, strict CSP, fully self-hosted assets (no CDNs/fonts). The HTML shell is served `no-store`; the content-hashed JS/CSS bundles are cached immutable — so no service worker pins stale code, but the client doesn't literally re-download everything each load. Same-origin still serves both the code and the SHA-256 manifest, so the source viewer is transparency for the honest-server case, not verified delivery against a malicious/compromised server. Traffic padding: dummy 256–383B frames at random 2–5s intervals + real payloads bucketed to 256B multiples — a partial defense against a passive on-path observer, none against the relay.
**Where I already know it's weak — please dig here:**
1. **Self-rolled Double Ratchet (\~460 LoC) and self-written SPAKE2** — primary review targets.
2. The SPAKE2 `roomId` is derived from the phrase (PBKDF2-100k → HKDF) and sent to the relay → an offline verifier for weak phrases, and **phrase entropy is not enforced** (12-char minimum, free text, no generator). Ephemeral scalars give FS so logged transcripts don't retroactively break; the real risk is an active MitM cracking a weak phrase inside the 30s pairing window. Considering forced high-entropy generated phrases (Magic-Wormhole style).
3. **No one-time prekeys** → weaker first-message FS than standard X3DH.
4. It's a PQXDH-*style* hybrid, not Signal's PQXDH; SPAKE2 is RFC-9382-*style* with custom M/N generators over ristretto255 (so not covered by the RFC test vectors).
5. Stable routing IDs + no header encryption → the relay can reconstruct the social graph.
**References (design family / specs)**
* X3DH — [https://signal.org/docs/specifications/x3dh/](https://signal.org/docs/specifications/x3dh/)
* Double Ratchet — [https://signal.org/docs/specifications/doubleratchet/](https://signal.org/docs/specifications/doubleratchet/)
* PQXDH — [https://signal.org/docs/specifications/pqxdh/](https://signal.org/docs/specifications/pqxdh/)
* SPAKE2 — RFC 9382: [https://www.rfc-editor.org/rfc/rfc9382.html](https://www.rfc-editor.org/rfc/rfc9382.html)
* ristretto255 — RFC 9496: [https://www.rfc-editor.org/rfc/rfc9496.html](https://www.rfc-editor.org/rfc/rfc9496.html)
* ML-KEM / FIPS 203 — [https://csrc.nist.gov/pubs/fips/203/final](https://csrc.nist.gov/pubs/fips/203/final)
Disclosure (rule 8): LLMs(Fable and Opus) were used and also to perform a code audit that surfaced the limitations listed above.