ecdh.html v1

A static page for emergency encrypted text (X25519 ECIES + AES-256-GCM). You host it; friends exchange tagged envelopes (CJK base4096 or Z85) over any channel — tapped, monitored, hostile. The channel just carries opaque blobs.

Full protocol spec and the pinned threat model: see README.md in the repo.

• Message contents against tapped/monitored transport
• Tampered or forged ciphertext — any modification fails decryption
• Key-substitution attacks — if you do the fingerprint ceremony
• Private key at rest — device storage and backup files are passphrase-wrapped (PBKDF2-SHA-256 800k + AES-GCM)
• Availability — static files, works offline, a saved copy runs from file://
• Long-term interoperability — the protocol spec is byte-exact, so envelopes and backups stay decryptable by any faithful reimplementation

• Sender authentication — anyone with your public key can send you a decryptable message. Judge senders by the voice ceremony and message context
• Replay or reordering — old but genuine messages can be re-sent to you
• Metadata & plaintext length — blobs are visibly crypto; who talks to whom, when, and the exact UTF-8 byte length of the plaintext (no padding) are visible
• Plaintext contacts & public keys at rest — your public key, saved contact names/keys, and last selected contact are stored unencrypted in localStorage (and in Chrome/Edge, all local file:// pages share one localStorage bucket)
• In-app browsers (WebViews), non-standard browsers, & extensions — chat-app WebViews and extensions/userscripts (e.g. Tampermonkey, auto-translate, AI sidebars) can read the page DOM and steal passphrases or plaintext
• Cloud keyboards (IMEs) & clipboard managers — third-party keyboards or OS/cloud clipboard history can capture what you type or copy
• A compromised device while you use the tool (keyloggers beat any passphrase)
• Forward secrecy against later key theft — history falls if the private key falls, so rotate your keys periodically
• Offline brute-force of a stolen key backup — offline attackers have no rate limit; PBKDF2 (800k) only slows them down, so passphrase strength is your real defense (at least 4 random words), keep backup copies few, and minimize where they are stored
• A forgotten passphrase — the key and all its messages are gone forever
• Automated multi-device sync or push notifications — there are none by design; to move to another device, manually export and re-import your encrypted key backup JSON (and optionally your contacts JSON)

• Call each other on a hard-to-tamper channel (voice). Agree: we use this system, for what, around when.
• Each reads the 12 emoji (or their English labels) under their own public key; the other checks them against the fingerprint shown for that contact.
• Do it in both directions. 12 emoji ≈ 72 bits — has never been feasible to fake for anyone in scope.
• Treat unexpected blobs outside agreed windows — or from unverified keys — with suspicion; this operational check substitutes for cryptographic sender signatures.
• Never skip or delegate the fingerprint check. Without it, messages stay confidential against passive eavesdroppers, but you have no guarantee of who sits on the other end.

• Download the raw index.html and crypto.js files from the repository into the same folder offline before you need them (avoid browser "Save Page As", which can break crypto.js or bake live screen state into the HTML). If running from file:// in Chrome/Edge, use a dedicated browser profile and never open downloaded .html files in it (or use Firefox or localhost).
• Export the passphrase-encrypted key backup (and optionally your contact list) and keep it somewhere survivable — iOS Safari may clear PWA storage after about a week of inactivity. The contacts JSON is unencrypted plaintext: store it somewhere trusted so nobody can swap a public key inside, and re-check fingerprints after importing it.
• Always open this page in standalone Firefox, Chrome, Edge, or Safari — never inside a chat app's built-in browser/WebView — and disable browser extensions (Tampermonkey, translation plugins, AI sidebars) on this page.
• Use your OS's built-in offline keyboard, and prefer reading decrypted messages on screen rather than copying plaintext to the clipboard.
• Never paste plaintext or the private key into any chat. Only envelopes and public keys.
• If adversaries upgrade to targeted nation-state: stop, use Signal/GPG/in person instead.