Identity and device keys
Created on each phone. The public halves are published so others can reach that phone; the private halves never leave it.
- Identity keyIK
- A device's long-lived signing key. It signs published prekeys, album key deliveries, epoch changes and join receipts.
- Long-term keyLK
- A device's long-lived key agreement key. It is kept separate from the identity key so no key is used for both signing and key agreement.
- Signed prekeySPK
- A key agreement key published in advance and signed by the identity key. It is replaced after 30 days. The phone keeps the previous one, and one older archived one, so deliveries made just before a replacement can still be opened.
- One-time prekeyOPK
- A key agreement key the server hands out at most once. When one is available it adds a fourth step to the handshake; when none are left, delivery still works with three.
- Prekey bundle
- What the server returns when a device asks how to reach someone: their identity key, long-term key, signed prekey with its signature and timestamp, and a one-time prekey if any remain.
- Miuchio ID
- A random 8 character handle a person shares so an admin can invite them.
Albums and epochs
An album is a set of people and a numbered sequence of keys.
- Album master keyMK
- The key for one epoch of one album. Every member of that epoch holds a copy. The server never receives it unencrypted.
- Epoch
- A numbered period of an album with its own master key. An album starts at epoch 0, and removing or losing a member starts the next one. Inviting someone does not: they receive the existing keys instead. A photo stays under the epoch it was uploaded in.
- Member token
- 32 random bytes that identify one person inside one album. The same person has a different token in every album. The server links it to an account only through an HMAC and an encrypted account ID, both keyed by a secret that is not stored in the database. One person's memberships still share the same HMAC, and signatures can be matched to the account that made them, an account with no name or email in it.
- Wrap
- One member's encrypted copy of an album master key. The album and epoch are bound into it, so it cannot be moved to another album or epoch.
- Envelope signature
- The admin's signature over a new epoch: the album, the epoch number, the exact list of recipients and every wrap. The server checks it before accepting the epoch. Members do not check it yet. Invites do not have one; each invite wrap carries only its own sender signature.
- Rotation required
- A flag the server sets on an album whenever someone is removed or leaves. Uploads are refused until the admin commits a new epoch, which clears it.
Media
Each photo has its own key; only that small key is protected by the album key.
- Data keyDEK
- A random key made for one photo and used for nothing else. The photo's thumbnail gets a separate one.
- Authenticated encryptionAEAD
- Encryption that also detects changes. A modified byte makes decryption fail instead of producing different content.
- Associated dataAAD
- Context such as an album ID, epoch or media ID that is checked during decryption without being encrypted. It stops a valid ciphertext from being moved somewhere it does not belong.
- Segmented encryption
- The format for files of 1 MiB or more. Each segment is bound to its position and to whether it is the last one, so a file cannot be reordered or cut short without failing to decrypt.
- Cache key
- A key that belongs to one phone and encrypts the photos, names and pins that phone keeps locally.
Trust and verification
How a phone decides that a key really belongs to the person it names.
- Safety number
- 30 digits derived from two people's identity keys and the album ID. If both phones show the same number, neither key was substituted.
- Trust on first useTOFU
- Accepting the first key seen for someone and remembering it. It does not protect that first moment, but it turns any later change into a visible one.
- Pin
- A stored copy of the identity key a phone accepted for someone in an album. Miuchio keeps separate pins for the member list and for who may sign key deliveries.
- Signer check
- The rule a phone applies before installing an album key: the sender's identity key must match what the phone already trusts for them, or this must be a genuine first join.