Security

Peer-to-Peer Messaging Protocol

gkMessenger uses the security protocol for peer-to-peer (p2p) communication. Waku relies on a network of peers to route messages to each other. Each message sent is broadcast to the entire network, and encrypted for only the intended recipient to open. By removing centralize choke points, the content of your messages and the metadata remain your own. However, gkMessenger and Waku are not entirely peer-to-peer yet, as mailservers are used to manage messages when a peer is offline. A Waku mailserver is a Waku extension that stores messages and delivers them when the peer comes back online.

End-to-End Encryption by Default

All private messages sent in gkMessenger are encrypted end-to-end by default. When you create a gkMessenger account, a cryptographic keypair is generated to encrypt your messages and stored locally on your device. When you add a new contact in gkMessenger, you exchange public keys so that that person can decrypt your messages when received over the network.

Perfect Forward Secrecy

PFS is a feature of specific key-agreement protocols which provide assurances that your session keys will not be compromised even if the private keys of the participants are compromised. Specifically, past messages cannot be decrypted by a third-party who manages to get a hold of a private key. It builds on the X3DH and Double Ratchet specifications from Open Whisper Systems, with some adaptations to operate in a decentralized environment. Perfect Forward Secrecy is an added layer of security for all of your 1:1 private chats

Pseudo-Anonymous Account Generation

When you create a new account on gkMessenger, you will never be asked for third party verification such as an email or phone number. This means you can sign up for and create a gkMessenger account and remain pseudo-anonymous. When you create an account, it is simply you and your keys. This also means that two factor authentication and password recovery are not features within gkMessenger - so be sure to remember your password and mnemonic phrase and store them offline somewhere extremely safe.

.