Breach news has become routine. A company gets broken into, and names, phone numbers and private messages end up for sale. We built Krypton Ø (Krypton zero) assuming our own server could be broken into some day. So the useful question isn’t whether it could happen. It’s what an attacker would walk away with.
What they would find
- Locked posts and envelopes. Posts, replies, photos, videos and link previews are locked on the writer’s phone before they reach us. The key to each post travels in a separate envelope for each reader, and only that reader’s phone can open it.
- Public keys. These are meant to be public. They let phones seal things for you, not open them.
- Locked recovery backups. The secret that opens a backup comes in two halves. One is on our server, the other is in the 18 words on your paper. Even taking our whole server won’t open it without the words.
- Mailboxes that aren’t tied to accounts. Posts, chats and cards go into mailboxes whose numbers change every 30 days.
What they wouldn’t find
- Phone numbers or email addresses. We never collect them. You join and sign in with the keys on your phone alone.
- Your name. It travels sealed inside your encrypted profile card.
- Your Fam list. It’s kept on your phone. The server only has an encrypted backup of it that it can’t open, and Krypton Ø never uploads your contacts.
- Who brought whom in, or who sent what to whom. Our server doesn’t store either.
- Who calls whom. A call rings, sealed, through the mailbox only the two of you share, and the server doesn’t record it.
- Private keys. They stay in the security core on your phone, in the iPhone Keychain or Android Keystore, and never leave it.
Couldn’t they open it later?
Some attackers keep stolen ciphertext, hoping to open it with a quantum computer one day. The outer layer that hands keys to readers is sealed with X25519 and ML-KEM-768 together, so both would have to be broken. The posts themselves are locked with 256-bit XChaCha20-Poly1305, which keeps enough strength against quantum computers. And every post and reply has its own key, so breaking one wouldn’t open the next.
Couldn’t they tamper with the server?
Someone in control of the server might try to slip in their own key, so that new posts get sealed to them. Public keys are bound to each account’s signature, so a swapped key fails the check and the phone rejects it. Calls work the same way: each phone signs the connection details, and if anything is swapped in the middle, the call doesn’t connect.
Taking over an account through recovery doesn’t work quietly either. Recovery needs both the 18 words and your PIN, and it completes only after a 48-hour wait. Your old phone sees the request in the meantime and can cancel it.
What they could still learn
We’d rather be clear about this part too.
- In the moment a request arrives, our server sees its IP address and time, which can link a mailbox to an account. Someone watching the server live, or reading its connection logs, could see that.
- For people the Krypton Ø team lets in directly, the server keeps that the team let them in.
- Call audio is encrypted between the two phones with the WebRTC standard, which isn’t post-quantum yet.
What no server can protect
A breach of our server leaves your posts locked. It can’t protect what happens on a phone, though: someone you hand your unlocked phone to, a phone already taken over by malware, or a camera pointed at the screen.
So if Krypton Ø’s server is ever breached, there’s a lot of ciphertext and very little else. The full design, with diagrams, is in Security design.