1# SophaxChat Threat Model23> Last updated: 2026-04-024> Version: Sprint 2 (MLS coordinator handoff, Android parity)56---78## 1. What SophaxChat Protects910| Asset | Where stored | How protected |11|---|---|---|12| Long-term identity keys (Ed25519 signing, X25519 DH) | iOS Keychain `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` | OS-level SEP / Secure Enclave isolation |13| MLS KeyPackage secret key | iOS Keychain (per-group, per-epoch) | Same Keychain policy |14| Message content (1-to-1) | AES-256-GCM encrypted JSON files in Application Support | `FileProtectionType.complete` — inaccessible when device locked |15| Message content (group, SKv2) | AES-256-GCM encrypted JSON files | `FileProtectionType.complete` |16| Message content (group, MLS) | Per-epoch MLS AEAD ciphertext on disk | `FileProtectionType.complete` |17| Attachments (images, audio) | AES-256-GCM in Application Support/sophax_attachments/ | `FileProtectionType.complete` |18| Contact list (peerAliases) | iOS Keychain (migrated from UserDefaults) | Keychain ACL |19| Identity export backup | PBKDF2-SHA256 720,000 iterations + AES-256-GCM, 16-char min passphrase | In-memory key zeroed after use |20| Key transparency log | HMAC-SHA256 append-only log in UserDefaults + MAC key in Keychain | Detects tampering of historical key bindings |2122---2324## 2. Attacker Model2526### In scope2728| Attacker | Capability |29|---|---|30| **Passive network observer** | Monitors Bluetooth/WiFi radio; sees encrypted frames, timing, and approximate proximity |31| **Active mesh attacker** | Can inject, replay, or drop mesh (MultipeerConnectivity) frames |32| **Malicious peer** | A SophaxChat peer who has established a session; can send crafted wire messages |33| **Compromised relay node** | A hop in the multihop relay path; can see ciphertext but not plaintext |34| **Server / infrastructure** | There are no servers; not applicable |35| **Physical access — locked device** | Can extract encrypted files from a powered-off or locked device |3637### Out of scope3839- Nation-state RF analysis or radio fingerprinting40- Physical access to an **unlocked** device (game over for any app)41- OS/kernel compromise or jailbreak42- Supply-chain attacks on the App Store build pipeline43- Legal coercion of the device owner44- Side-channel attacks on Secure Enclave4546---4748## 3. Attack Surface4950### 3.1 Mesh Transport (MultipeerConnectivity)5152-**Unauthenticated frames**: Every received frame is verified against the sender's Ed25519 signing key (derived from their bundle's peerID). Frames with invalid signatures are dropped before any parsing.53-**Relay amplification**: TTL=6, LRU dedup cache prevents replay and loops. Relay nodes cannot read ciphertext.54-**Offline queue**: Messages queued for offline peers are stored encrypted; the relay node never holds plaintext.55-**Missing mitigation**: Bluetooth/WiFi proximity leaks that two devices are near each other, regardless of message content. This is inherent to the transport.5657### 3.2 TCP Transport (optional, over Tor)5859-**Frame size pre-check**: `TCPTransport.maxFrameSize` guard rejects oversized frames before allocation.60-**Tor**: When enabled, routes TCP connections through Tor hidden services — hides IP from the remote peer. Tor is optional; the user can toggle it in Settings.61-**Missing mitigation**: TCP without Tor exposes the user's IP to their peer.6263### 3.3 Wire Protocol6465-**WireMessage**: Signed with sender's Ed25519 key on every message. Receiver verifies before dispatch.66-**Sealed sender**: Sender identity is encrypted to the recipient's bundle — relay nodes cannot correlate sender ↔ recipient for 1-to-1 messages.67-**Header encryption**: DR-encrypted message headers prevent relay nodes from reading metadata (message type, reply-to ID, etc.).68-**Replay prevention**: Nonce embedded in DR ratchet state; old nonces rejected. MLS epoch counter prevents replaying old Commits.6970### 3.4 1-to-1 Messaging (X3DH + Double Ratchet)7172-**X3DH**: Extended Triple Diffie-Hellman for session initialization. Provides forward secrecy from message 1.73-**Double Ratchet**: Per-message ratchet (ChaCha20-Poly1305 AEAD). Compromise of one message key does not expose past or future messages.74-**Post-compromise security**: DR break-in recovery after key compromise — new DH output heals the session.75-**Missing mitigation**: If a peer's device is seized while unlocked and a session is active, past plaintext cached in memory may be readable.7677### 3.5 Group Messaging — Sender Keys v2 (SKv2)7879-**Per-member HMAC-SHA256 chain**: Each sender has their own KDF chain. Compromise of one sender's key does not expose other members' messages.80-**Auto-rotation**: Sender keys rotate every 500 messages or 7 days. After rotation, a compromised old key cannot decrypt new messages.81-**Leave recovery**: When a member leaves, remaining members rotate immediately — the leaver cannot decrypt future messages.82-**Known limitation**: SKv2 provides *break-in recovery* only after rotation. Between join and next rotation, a compromised device has read access to all group messages from all senders (no post-compromise security per epoch). MLS fixes this.83-**Known limitation**: Group membership is enumerable by any member — all member peerIDs are in `GroupInvitePayload` and `GroupWireMessage`.8485### 3.6 Group Messaging — MLS (RFC 9420)8687-**Post-compromise security per epoch**: Each MLS Commit advances the epoch and derives fresh secrets. A compromised device is healed at the next Commit.88-**Forward secrecy per epoch**: Old epoch secrets are deleted after the Commit. Past messages are not decryptable after key deletion.89-**Coordinator authority**: Only the current coordinator (initially the creator, transferable via handoff) may issue Commits. Non-coordinator members who attempt to commit are rejected.90-**Coordinator handoff**: `mlsCoordinatorHandoff` wire message transfers authority. Only the current coordinator can sign a valid handoff. Recipients verify sender == current coordinator.91-**Known limitation**: The coordinator is a single point of trust for group membership changes. If the coordinator's device is compromised, an attacker can add or remove members without consent. Mitigated by distributing coordinator authority via handoff.92-**Known limitation**: No multi-device support. An MLS group is anchored to a single device's KeyPackage. Adding the same identity on a second device is not yet supported.9394### 3.7 Keychain and Local Storage9596-**`kSecAttrAccessibleWhenUnlockedThisDeviceOnly`**: Keys are inaccessible when the device is locked and cannot be migrated off the device (no iCloud Keychain sync for these items).97-**Full account wipe**: `ChatManager.wipeAllData()` deletes all Keychain items, message files, attachments, and UserDefaults.98-**App lock**: Face ID / Touch ID gate via LocalAuthentication. State is cleared in memory on background.99-**Known limitation**: A forensic extraction from a locked (but previously-unlocked) device might recover decrypted pages from the SQLite WAL or AES-GCM plaintext from process memory before the OS evicts it. FileProtection.complete mitigates but does not eliminate this.100101### 3.8 Identity Export102103-**PBKDF2-SHA256, 720,000 iterations**: Expensive key derivation to resist offline brute-force.104-**16-character minimum passphrase**: Enforced at backup creation time.105-**Memory zeroing**: Derived key bytes are zeroed immediately after use.106-**Known limitation**: An export file stored in iCloud Drive or a photo library is only as secure as the passphrase.107108---109110## 4. Trust Assumptions1111121. **iOS / Android OS**: The OS Keychain and Secure Enclave are not compromised.1132. **App Store build**: The SophaxChat binary in the App Store has not been tampered with.1143. **mls-rs library**: The RFC 9420 implementation is correct and free of side-channel vulnerabilities.1154. **No server**: There is no backend. No third party stores messages or metadata.1165. **Peer identity**: A peer's identity is bound to their Ed25519 key pair. SophaxChat does not verify that a key pair belongs to a specific human — users must verify Safety Numbers out-of-band.117118---119120## 5. Cryptographic Primitives121122| Primitive | Usage |123|---|---|124| Ed25519 | Message signing, identity binding |125| X25519 | X3DH and Double Ratchet DH steps |126| ChaCha20-Poly1305 | AEAD for 1-to-1 and group (SKv2) message encryption |127| HMAC-SHA256 | SKv2 KDF chain ratchet, Key Transparency Log MAC |128| AES-256-GCM | At-rest encryption for messages, attachments, identity export |129| PBKDF2-SHA256 | Identity export key derivation (720,000 iterations) |130| MLS (RFC 9420) | Group v3 — per-epoch PCS, per-epoch forward secrecy |131132---133134## 6. Known Limitations Summary135136| # | Limitation | Severity | Mitigation |137|---|---|---|---|138| 1 | SKv2 groups: no PCS between rotations (max 500 msgs / 7 days) | Medium | Upgrade group to MLS via in-app migration |139| 2 | Group membership enumerable by all members | Low | Acceptable for a group messaging model |140| 3 | MLS coordinator = single point of group admin trust | Medium | Coordinator handoff distributes authority |141| 4 | No multi-device support | Medium | Out of scope for v1; planned for later |142| 5 | Bluetooth/WiFi proximity leak (transport-level) | Low | Inherent to MPC/Nearby Connections; Tor only helps TCP path |143| 6 | TCP without Tor exposes IP to peer | Medium | Tor toggle in Settings; default on |144| 7 | Memory forensics on unlocked/recently-locked device | Medium | App lock clears in-memory state; FileProtection.complete limits disk exposure |145| 8 | No independent security audit | High | Planned before public App Store launch |146147---148149## 7. Out of Scope150151The following are explicitly out of scope for SophaxChat v1:152153-**Anonymity network**: SophaxChat hides message content but not proximity. Two users near each other using the app are observable at the RF layer.154-**Deniability**: Messages are signed by the sender's Ed25519 key. This is intentional (integrity guarantee) but means messages are not cryptographically deniable.155-**Key revocation**: There is no mechanism to revoke a compromised long-term identity key. Users should do a full account wipe.156-**Server-assisted features**: No push notifications via APNs (messages require the app open), no contact discovery, no phone number verification.