phantom-core

The cryptographic core of PHANTOM, a private, end-to-end encrypted messenger. This repository is published for independent audit: it is the exact library the app is built on, so anyone can verify the security claims for themselves instead of taking our word for it.

This is the client-side cryptographic library only. It contains no keys, no credentials, and no server code — nothing secret. Everything here also ships inside the app binary and is therefore already readable by anyone who reverse-engineers it; publishing it just makes that honest and easy.

What it does

Area	Primitive / protocol
Key exchange	PQXDH — X25519 + ML-KEM-768 (post-quantum hybrid)
Message encryption	Double Ratchet over ChaCha20-Poly1305
Transport	Noise_IK inside TLS 1.3 (server key pinned)
Sender privacy	Sealed Sender — the relay never sees who is writing
Signatures	Ed25519
Key derivation	HKDF-SHA-256
Group messaging	MLS (RFC 9420) via OpenMLS
Key transparency	Sparse Merkle Tree, root anchored on Base L2
Memory hygiene	secret material is zeroized on drop; comparisons are constant-time (subtle)

Verify it yourself

cargo build --release      # builds standalone, no private dependencies
cargo test  --release      # 312 tests, incl. property + stress tests

The tests are the point: they assert the actual behaviour of the key exchange, ratchet, AEAD, sealed sender and Merkle-proof verification — including negative cases (wrong key → different secret, tampered ciphertext → rejected).

What is not here

• No server. No message storage. No push infrastructure.
• No private keys, API keys, wallet keys, RPC secrets or .env files. Blockchain signing takes the private key as a runtime parameter, never hardcoded.
• No iOS/Android app code. The apps consume this library over a thin FFI.

Layout

src/crypto/        ML-KEM, X25519, Ed25519, ChaCha20-Poly1305, HKDF
src/ratchet/       Double Ratchet
src/protocol/      PQXDH, Sealed Sender, media, tokens
src/transport/     Noise_IK, TLS, WebSocket, SOCKS5, (optional) WireGuard
src/mls/           MLS group messaging
src/transparency/  Sparse Merkle Tree + on-chain anchoring / kill switch

License

Dual-licensed under MIT or Apache-2.0, at your option.

Reporting a vulnerability

See SECURITY.md. Please report privately before public disclosure.