Zero-Server Cryptography & Privacy Assurance
Full technical breakdown of CipherCore's cryptographic primitives, zero-knowledge threat model, and client-side memory safety guarantees for GitHub Pages deployment.
Cryptographic Specifications
CipherCore relies strictly on standard W3C Web Cryptography API (window.crypto.subtle) primitives implemented directly in modern browser engines (V8, JavaScriptCore, Gecko), avoiding untrusted third-party JavaScript crypto libraries.
| Security Layer | Primitive & Parameter | Standard Reference |
|---|---|---|
| Password Generator | CSPRNG (16-char default, ~102 bits) | crypto.getRandomValues |
| Key Derivation (KDF) | PBKDF2-HMAC-SHA-256 (600,000 rounds) | OWASP KDF Guidelines / RFC 8018 |
| Symmetric Encryption | AES-256-GCM (128-bit AEAD tag, 96-bit IV) | NIST SP 800-38D |
| Forward Secrecy (PFS) | ECDH (NIST P-256 / secp256r1) | RFC 6090 / ANSI X9.62 |
| Out-of-Band SAS | 60-digit iterated SHA-256 (5,200 rounds) | Signal Protocol SAS Standard |
| Network Transport | WebRTC DataChannels (SCTP over DTLS) | RFC 8831 / WebRTC 1.0 |
Threat Model & Defense Vector Analysis
1. Host / Server Eavesdropping (GitHub Pages)
GitHub Pages acts exclusively as a static file delivery CDN for HTML, CSS, and JS assets. No server-side scripting (PHP, Node, Python) exists. Once files are loaded in your browser cache, communication occurs directly browser-to-browser via WebRTC DataChannels. Even if GitHub or an ISP monitors HTTP traffic, they only see static code files.
2. URL Hash Security (#room=...&key=...)
When sharing 1-click invite links, the room code and 16-character key are placed after the # (hash fragment). In accordance with RFC 3986, URL hash fragments are strictly client-side and are never transmitted in HTTP request headers to web servers or proxies.
3. Physical Surveillance & Shoulder Surfing
- Automatic Privacy Blur: Whenever the browser tab or window loses focus, the entire chat window is blurred and brightness dimmed.
- Decoy Mode: Instantly disguises the application as a functioning dark calculator widget.
- Panic Wipe (Esc): Immediately overwrites cryptographic keys in RAM with zeroes, terminates WebRTC connections, purges DOM messages, and redirects the tab to DuckDuckGo.
Live In-Browser Cryptographic Benchmark
Verify your browser's native Web Crypto API performance and validate that cryptographic primitives operate properly with zero errors: