Security
Wisp is built to keep your messages and your social graph private even when the infrastructure carrying them is hostile. This page summarizes how, and is deliberately honest about the limits. For the byte-level detail, see the Protocol Overview.
Cryptography
Section titled “Cryptography”Wisp invents nothing. It composes well-established, widely-reviewed primitives:
| Purpose | Primitive |
|---|---|
| Identity / signatures | Ed25519 |
| Key agreement | X25519 |
| Handshake | Noise XX (Noise_XX_25519_ChaChaPoly_SHA256) |
| Message encryption | ChaCha20-Poly1305 |
| Ratchet / key derivation | Signal Double Ratchet (with header encryption), HKDF-SHA256 |
| Hashing | SHA-256 |
Every conversation runs a Noise XX handshake and then a Double Ratchet — the same construction Signal uses — which provides forward secrecy (a compromised key doesn’t expose past messages) and post-compromise recovery (the session heals after a compromise).
Identity and verification
Section titled “Identity and verification”- Your identity is an Ed25519 keypair; its public half, in text, is your WispID. It is self-certifying — there’s no registry to trust or seize.
- The Noise handshake authenticates transport keys; both peers then exchange signed identity proofs bound to that specific handshake, so each side learns the other’s verified WispID, not just a transport key.
- A safety number derived from both identities lets two people confirm out of band that no one is impersonating them.
Metadata protection
Section titled “Metadata protection”- Message sizes are padded to fixed buckets (256 / 1024 / 4096 bytes), so ciphertext length leaks only the bucket.
- Dead-drop addresses are derived from a shared secret and rotate every hour, and are unlinkable — a relay can’t tell who wrote or read a drop, or link two drops as one conversation.
- Relays and DHT nodes see only opaque blobs at unguessable addresses.
What’s protected
Section titled “What’s protected”- Message content — end-to-end encrypted and forward-secret.
- The social graph — rotating, derived, unlinkable drop addresses.
- Against central seizure — no server holds messages or contacts.
- Against takedown — clients route around blocked relays and bootstrap nodes.
What’s not fully solved
Section titled “What’s not fully solved”Being honest about the threat model matters:
- Global passive timing correlation. An adversary who can watch the entire network at once might correlate the timing of a message being sent and received.
- Endpoint compromise. If your device is compromised, no messaging app’s encryption can save the plaintext that lives there.
- Bootstrap dependence. Getting online at all depends on reaching a bootstrap node — the softest point for censorship.
- Drop availability. A drop survives only as long as at least one relay holds it; redundancy is probabilistic, not guaranteed.
The honest claim
Section titled “The honest claim”Wisp does not remove infrastructure; it relocates it into things that are swappable, blind, and non-identifying. The claim is not “no servers.” It is:
No trusted party, and no single point that can read you, link you, or be leaned on to make you stop.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Found a security issue? Please report it privately to mahdi.business7@gmail.com rather than opening a public issue, so it can be fixed before disclosure.