Kryfo analysis and deployment: post-quantum messaging over embedded Tor onion and anti-forensics

Kryfo analysis and deployment: post-quantum messaging over embedded Tor onion and anti-forensics

In the modern landscape of secure communications, the compromise between user convenience and privacy has pushed most mainstream platforms into architectural concessions that clash with core cypherpunk principles. Highly regarded platforms such as Signal tie user identities to telephone numbers and rely on centralized cloud backends (AWS) utilizing proprietary SGX hardware enclaves. Session, while ditching phone numbers and central servers via the decentralized Oxen network, introduces Proof-of-Stake (PoS) consensus overhead and distributes onion routing metadata across public service nodes. SimpleX Chat has introduced a revolutionary paradigm with isolated unidirectional message queues and zero global IDs, yet it still requires trust in external relay infrastructure exposed on the open Internet.

When the adversary is not merely a passive wiretapper, but an entity conducting traffic correlation analysis, physical forensic device extraction under seizure or coercion, and preventive bulk data harvesting targeted for cryptographically relevant quantum computers (Harvest Now, Decrypt Later), threat modeling must become uncompromising.

What is Kryfo: principles and philosophy

Kryfo (GnosiWorks, created by Marios, derived from the Greek Κρυφό, meaning "hidden" or "secret") is an autonomous cross-platform messaging application engineered to operate without any centralized proprietary infrastructure.

Unlike traditional platforms, Kryfo is grounded in radical assumptions:

• Zero accounts, zero personal data: No telephone numbers, email addresses, centralized usernames, or global unique identifiers.
• Pure peer-to-peer topology over Tor Onion v3: Every client embeds a native Tor daemon in-process. There are no central servers storing or routing messages; peers communicate directly through 6-hop cryptographic rendezvous circuits.
• Zero cleartext metadata: IP addresses are never exposed to the counterparty, ISPs, or intermediary nodes.
• Proactive post-quantum protection: Messages are shielded by a post-quantum double ratchet combining lattice-based algorithms with classical Diffie-Hellman.
• Extreme anti-forensics design: Built to safeguard the user even in scenarios involving physical device seizure, technical searches, or coerced password extraction.

How to use Kryfo: installation, contacts, and multi-device pairing

Kryfo provides a seamless experience across Android, Linux (native desktop), macOS, and Windows, without any formal account registration process.

1. Installation and local identity generation

Upon first launch on mobile or desktop, Kryfo requires no login credentials or third-party verifications:

1. It locally generates cryptographic keypairs (identity keys, ephemeral ratchets, and private Tor v3 .onion hidden service descriptors) directly within the encrypted database.
2. It prompts the user to set a security PIN used to derive the master key for the local SQLCipher storage.
3. Users can optionally configure two safety mechanisms: a Decoy PIN (which unlocks an authentic decoy interface populated by harmless chats) and a Wipe PIN (which triggers instant cryptographic data destruction under duress).

2. Adding contacts and the rendezvous circuit

To initiate a conversation with another user:

1. Share your QR Code or contact string (containing your ephemeral onion v3 address and public identity key).
2. The counterparty scans the QR code or imports the string into their contacts tab.
3. Both internal Tor runtimes negotiate an anonymous 6-hop v3 onion circuit (3 hops selected by the sender, 3 by the receiver) meeting at an untrusted Rendezvous Point. Neither peer discovers the physical location or IP address of the other.

3. Multi-device pairing (smartphone and desktop)

Kryfo allows users to link one or more secondary workstations (such as a Linux desktop or laptop) to their primary mobile device:

• Pairing via QR Code: From the desktop client, choose Link Device and scan the displayed QR code with your primary smartphone app.
• Strict vault isolation: The desktop client never synchronizes or displays contacts and conversations stored inside the hidden Vault. Vault boundaries remain strictly quarantined to mobile hardware.
• Smartphone-initiated handshake: When a newly linked desktop client initiates a conversation with an existing peer, the protocol mandates that the initial presentation frame originate from the primary smartphone. This prevents local desktop malware from impersonating the user without physical mobile authorization.

Architectural strengths and core features

Kryfo's architecture incorporates high-level cryptographic and operational protections:

flowchart LR
    subgraph ClientA ["Sender: Kryfo Mobile"]
        TorA["Embedded Tor Runtime\n(libhalo.so)"]
        VaultA["SQLCipher Encrypted DB\n(Visible Area + Vault)"]
        KDF_A["Linux/Android Kernel\nPR_SET_DUMPABLE=0"]
    end

    subgraph Transport ["Tor Anonymity Network"]
        Bridge["Private Obfs4 Bridge\n(Optional, Anti-DPI)"]
        RelayIn["Guard Node"]
        Middle["Middle Relays"]
        Rendezvous["Tor Rendezvous Point v3\n(6 Hop Circuit)"]
    end

    subgraph PushGateway ["Blind Push Notifications"]
        Ntfy["ntfy.example.org Server\n(ACL: up* read-write)"]
    end

    subgraph ClientB ["Receiver: Kryfo Desktop/Mobile"]
        TorB["Embedded Tor Runtime\n(libhalo.so)"]
        VaultB["SQLCipher DB"]
    end

    ClientA -->|Tor Circuit| Bridge
    Bridge --> RelayIn
    RelayIn --> Middle
    Middle --> Rendezvous
    Rendezvous <--> ClientB

    ClientA -.->|Dummy Blind Beacon on upX| Ntfy
    Ntfy -.->|Wakeup Signal| ClientB

1. In-process Tor runtime (libhalo.so)

Kryfo does not depend on system daemons (/usr/bin/tor) or external mobile helper apps like Orbot. The Tor core is compiled into a native C/Rust shared library (libhalo.so) bundled inside the app and driven via FFI.

• Each instance independently manages bootstrap and circuit creation.
• No local SOCKS proxy ports are left open, preventing other applications on the same device from probing Tor sessions.

2. Hybrid post-quantum double ratchet (PQXDH and SPQR)

Messages do not rely solely on Tor transport-level onion encryption. At the application layer, Kryfo implements a post-quantum extension of the double ratchet:

• Hybrid pairing: Blends classical elliptic-curve Diffie-Hellman (X25519) with lattice-based key encapsulation (Kyber-1024 / ML-KEM). Even if Shor's algorithm on a quantum computer resolves discrete logarithms on elliptic curves, passively recorded messages remain undecryptable.
• Symmetric Post-quantum Ratchet (SPQR): Symmetric session keys advance through a one-way KDF for every discrete message, ensuring both Forward Secrecy and Break-in Recovery.

3. Traffic-analysis resistant UnifiedPush notifications

Maintaining constant background Tor TCP connections on mobile causes severe battery drain and OS process culling. Kryfo solves this via UnifiedPush:

• 16 deterministic slots with blind payloads: The client registers 16 static topics (up0 .. up15) on an ntfy push server. Push wakeups contain only fixed-size random padding: the push server learns neither the sender, the recipient, nor the subject matter.
• 30-day resting cycles: Active slots rotate into dormant periods to prevent long-term statistical traffic correlation.
• Zero push for hidden chats: To preserve plausible deniability, hidden vault chats never generate push notifications. Incoming vault messages are polled asynchronously when the vault is unlocked or via randomized Tor sweeps.

4. Anti-forensics hardening and plausible deniability

Kryfo integrates defenses against extraction hardware (e.g., Cellebrite devices) and physical coercion:

• PR_SET_DUMPABLE, 0 syscall: Prevents external processes or debuggers (via ptrace or /proc/$PID/mem) from reading application RAM. It also disables memory core dumps on abnormal termination.
• Plausible database partitioning (SQLCipher):
  • Real PIN: Unlocks both standard conversations and the encrypted vault.
  • Decoy PIN: Unlocks a realistic decoy UI containing only innocuous conversations, leaving no cryptographic trace of hidden compartments.
  • Wipe PIN: Instantly overwrites encryption keys with random entropy, destroys database headers, and halts the app. Data recovery becomes mathematically impossible.

Our Linux deployment and debugging model

During compilation, porting, and stress-testing on Linux x86_64, we diagnosed and resolved multiple low-level issues:

1. Comparison with competing platforms

2. Resolving SQLCipher symbol collisions

On desktop Linux distributions, system components may load /usr/lib/libsqlite3.so.0. When Kryfo loaded its statically linked SQLCipher library, the dynamic linker (ld-linux) resolved database symbols against standard, unencrypted SQLite symbols. This produced runtime errors such as file is not a database.

We resolved this by injecting the following linker directive:

LDFLAGS += -Wl,-Bsymbolic

This forces the linker to prioritize internal symbols inside SQLCipher before inspecting the global symbol table.

3. Handling XDG desktop portals with PR_SET_DUMPABLE

When an application invokes PR_SET_DUMPABLE, 0, D-Bus services like xdg-desktop-portal fail to inspect /proc/$PID/ to verify caller credentials. Requests for native dialogs (such as file choosers) failed with:

org.freedesktop.portal.Error.Failed: AccessDenied

The solution involves handling file descriptors explicitly or dispatching file dialogues through isolated worker threads without lowering memory protection on the primary secret-holding thread.

Optional addendum: configuring a private obfs4 Tor bridge

Note: this section is completely optional. Kryfo connects out-of-the-box through standard public Tor guard nodes without requiring personal server infrastructure.

1. When is a dedicated bridge useful?

Deploying a Private Obfs4 Bridge is advantageous in specific scenarios:

• Censorship circumvention: Bypassing aggressive DPI firewalls in restrictive network environments where known Tor public guard nodes are blocked.
• Enhanced anonymity: An unlisted private bridge ensures local ISPs cannot even deduce that the client is connecting to the Tor network.

2. Docker Compose and private torrc configuration

Create /opt/kryfo-bridge with the following docker-compose.yml:

services:
  kryfo-bridge:
    image: thetorproject/obfs4-bridge:latest
    container_name: kryfo-bridge
    restart: always
    environment:
      - OR_PORT=9001
      - PT_PORT=9443
      - [email protected]
    ports:
      # Expose only the obfuscated obfs4 transport port
      - "9443:9443"
    volumes:
      - /opt/kryfo-bridge/torrc:/etc/tor/torrc:ro
      - /opt/kryfo-bridge/data:/var/lib/tor

In /opt/kryfo-bridge/torrc, the directive PublishServerDescriptor 0 is crucial: it prevents Tor from announcing your bridge to public directory authorities:

BridgeRelay 1
Nickname KryfoPrivateGuard
ContactInfo [email protected]

# CRITICAL: Do not publish this bridge to public Tor directories
PublishServerDescriptor 0

ORPort 9001
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:9443
ExtORPort auto

ExitRelay 0
ExitPolicy reject *:*
DataDirectory /var/lib/tor

3. Startup, bridge line extraction, and QR code generation

Start the container and obtain the bridge line:

sudo mkdir -p /opt/kryfo-bridge/data
sudo chown -R 100:100 /opt/kryfo-bridge/data
cd /opt/kryfo-bridge && sudo docker compose up -d

# Allow roughly 30 seconds for key generation
sudo cat /opt/kryfo-bridge/data/pt_state/obfs4_bridgeline.txt

The resulting bridge line has the format:

Bridge obfs4 203.0.113.50:9443 A1B2C3D4E5F60718293A4B5C6D7E8F9012345678 cert=abcdef0123456789ABCDEF... iat-mode=0

To import it on mobile, render it as an ASCII QR code:

sudo apt-get install -y qrencode
BRIDGE_LINE=$(sudo cat /opt/kryfo-bridge/data/pt_state/obfs4_bridgeline.txt | grep -E '^Bridge')
qrencode -t ANSI256 "$BRIDGE_LINE"

Scanning this code inside Kryfo (Settings -> Network -> Custom Bridge Configuration) routes all client traffic through your private obfuscated relay, concealing Tor network signatures from network observers.

Conclusion

Although Kryfo carries an "Alpha" designation in its repository, its underlying cryptographic engineering and rigorous defense-in-depth measures reflect exceptional maturity.

By combining in-process Tor rendezvous routing, PQXDH, kernel-level memory defense via PR_SET_DUMPABLE, plausible deniability via Decoy/Wipe PINs, and blind metadata-free push mechanisms through UnifiedPush, Kryfo directly addresses vulnerabilities left unresolved by conventional messaging systems.

For individuals operating in high-threat environments where communications must remain resilient against both network surveillance and physical device coercion, Kryfo stands as one of the most uncompromising architectures available in modern open-source software.

Discussion & Support

Discussion and support channel. To discuss configurations or other topics, join us on fluxer.dreadful.work.