Skip to content

PHANTOM Alpha 2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@LiudvigVladislav LiudvigVladislav released this 19 Jul 14:59
· 382 commits to master since this release
v0.1.0-alpha.2
53bc72d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHANTOM Alpha 2

A protocol-hardening snapshot focused on real X3DH, identity-key separation, and a safe Alpha 1 → Alpha 2 migration.

Tagged on 2026-04-30. This release documents the exact state of v0.1.0-alpha.2; it does not include the later Alpha 2 work that subsequently landed on master.

Looking for the current state of the project? See the
README on master —
development has moved substantially beyond this tag.

Highlights

Alpha 2 replaces the provisional Alpha 1 session bootstrap with a real X3DH four-DH handshake, separates long-term identity signing from ratchet key material, adds signed and one-time prekeys, and provides an explicit migration path for existing Alpha 1 identities.

The existing X25519 identity is preserved, so users retain the same public identity and QR code. Protocol-incompatible Alpha 1 ratchet state is intentionally discarded and re-established under the hardened handshake.

Cryptographic hardening

  • Real X3DH four-DH session bootstrap with a SignedPreKey and optional OneTimePreKey.
  • Fresh ephemeral X25519 keypair per new session, closing the Alpha 1 identity-as-ratchet-seed weakness.
  • Two-keypair identity model:
    • X25519 identity key remains the stable public identity.
    • A new Ed25519 identity-signing key authenticates SignedPreKey bundles.
  • SignedPreKey verification before a session is accepted.
  • OneTimePreKey consumption for stronger first-session forward secrecy.
  • HKDF-SHA256 session derivation with a versioned PHANTOM X3DH salt.
  • SessionManager rewrite so first-message bootstrap and subsequent Double Ratchet traffic use the new protocol consistently.
  • The inactive SenderKey-signing design and its limitations are documented in ADR-017 rather than presented as a working group-signature mechanism.

See ADR-009 for the key hierarchy and handshake design.

Prekey infrastructure

  • Relay endpoints for publishing, fetching, checking and consuming prekey bundles.
  • A 1:1 binding between the preserved X25519 identity and the new Ed25519 signing key; conflicting bindings are rejected.
  • Local SQLDelight storage for SignedPreKeys and OneTimePreKeys.
  • Initial publication of one SignedPreKey and 100 OneTimePreKeys.
  • Automatic OPK replenishment when the local pool falls below 20 keys.
  • Weekly SignedPreKey rotation.
  • Prekey lifecycle wiring during onboarding and application startup.

Alpha 1 → Alpha 2 migration

Existing Alpha 1 installations are detected automatically on first launch.

The migration:

  1. Preserves the existing X25519 identity and public QR-code identity.
  2. Generates and persists a new Ed25519 signing keypair.
  3. Generates and publishes the new signed/one-time prekey bundle.
  4. Removes old ratchet and SenderKey states rooted in the provisional Alpha 1 bootstrap.
  5. Marks affected conversations as requiring a new handshake.
  6. Preserves previous messages as read-only history.

The migration is designed to be idempotent and resumable if the network or relay becomes unavailable during prekey publication.

Because the wire protocol changed, Alpha 1 and Alpha 2 sessions are not mutually compatible. Contacts must migrate and re-establish their sessions; the app does not silently fall back to the weaker Alpha 1 handshake.

See the migration document for the detailed flow and recovery cases.

Privacy, safety and application changes

  • Android FLAG_SECURE protection blocks screenshots and recent-app thumbnails.
  • Safety Number verification is wired to the real identity fingerprint calculation.
  • Message Requests now require confirmation before blocking a sender.
  • Client-side reporting is connected to the relay report endpoint.
  • Per-conversation mute and pin controls.
  • Consolidated long-press message actions and clearer pin attribution.
  • Voice recording moved to OGG/Opus at 48 kHz mono / 48 kbps.
  • Standard, Private and Ghost privacy-mode configuration surfaces were added. Their advanced transport behavior is not part of this tagged snapshot.
  • Unsupported or incomplete Phase 3 features are hidden or shown with honest empty states.

Interface refresh

The Android client received its first complete PHANTOM design-system pass:

  • shared color, spacing and typography tokens;
  • bundled Geist, Inter and JetBrains Mono variable fonts;
  • refreshed chat list, bubbles, composer and chat header;
  • revised onboarding, profile, settings and verification surfaces;
  • consistent archive, saved-message, contact, request and group shells;
  • corrected navigation, iconography, ripples and empty states.

Some of these screens are foundations for later features and should not be read as proof that every represented feature is operational in this tag.

CI and verification

The repository gained GitHub Actions coverage for:

  • Android builds and JVM tests;
  • Rust relay tests;
  • Codeberg mirroring.

The tagged protocol-hardening surface records 83 targeted tests:

  • 11 X3DH four-DH crypto vectors;
  • 10 SessionManagerTest cases;
  • 9 DefaultMessagingServiceTest bootstrap cases;
  • 8 MigrationManagerTest cases;
  • 7 PreKeyLifecycleServiceTest cases;
  • 17 relay unit and HTTP-integration tests;
  • 11 PreKeyApiClient tests;
  • 10 IdentityManagerTest cases.

Known limitations

This remains an early Android pre-release:

  • The tag predates the later Xray/REALITY, Tor and REST-fallback work now present on master; transport in this snapshot is direct WSS.
  • The custom Double Ratchet/X3DH implementation over libsodium has not received an independent third-party cryptographic audit.
  • Alpha 1 contacts must migrate before an Alpha 2 peer can establish a new session with them.
  • Existing conversation history remains readable, but old sessions are intentionally invalidated and contacts must be re-established.
  • At this tag, voice delivery was not reliable on the tested Tecno/HiOS path without a VPN; later work on master (REST fallback, encrypted media pipeline) addresses this.
  • The relay PreKeyStore uses in-memory state with JSONL persistence and is not yet designed for large-scale deployment.
  • No iOS or production web client is included.
  • Groups, channels, attachments and nearby mesh communication are not available as complete user-facing features.
  • No Alpha 2 APK is attached to this release; GitHub provides source archives for the tag.
  • The annotated Git tag is not cryptographically signed.

See the known-issues snapshot at this tag and the current register on master.

Documentation

Full changelog

Alpha 2 contains 66 commits after Alpha 1:

v0.1.0-alpha.1...v0.1.0-alpha.2

Assets 2
Loading