VedaONE cryptographic architecture
Transport, application, device and compliance layers.
VedaONE protects communications in four layers. The server stores only ciphertext; messages are encrypted with ephemeral epoch keys.
| Layer | Mechanism |
|---|---|
| 1 · Transport | Mutual TLS 1.3 with hybrid post-quantum key agreement; hardware-pinned X.509 device certificates |
| 2 · Application | PQXDH for direct messages; IETF MLS TreeKEM (RFC 9420) for groups |
| 3 · On-device | Hardware vault storage (Android StrongBox, Apple Secure Enclave) and biometrics |
| 4 · Compliance | Two-Person Integrity: Shamir Secret Sharing, k=2 of n=3 |
Post-quantum algorithms
Key agreement and signatures combine classical algorithms with the NIST post-quantum algorithms ML-KEM-768 and ML-DSA-65.
Blind push
- The payload is stored encrypted on the VedaONE core.
- A blind wake-up ping carrying only an ephemeral sync token is sent through FCM — no message text or names.
- The handset opens an mTLS 1.3 connection to the sovereign gateway and presents the token.
- Encrypted data is fetched and decrypted on the device using hardware-backed keys.