Metadata-resistant, account-less communication
Seven research directions in applied cryptography for a messenger whose relay is deaf — including a published negative result.
Koch Laboratory — Privacy & Applied Cryptography Research
Koch Laboratory researches metadata-resistant, account-less communication — systems whose relaying server is “deaf”: it knows neither the identities, nor the keys, nor the social graph of its users. Below are the current research directions. Each resolves a concrete, unsolved technical problem for which no off-the-shelf solution exists.
Method. Each direction runs as a process: problem statement → hypothesis → reference implementation in two independent languages (Python/Dart) bound by shared test vectors → verification as a testable property. Dated project documentation and test discipline preserve the result across iterations.
Publication note (IP). For patentable directions we publish the problem, the state of the art and the success criterion — not the solution’s construction. Reason: the EPC provides no grace period; public disclosure of a working solution before any filing irreversibly destroys novelty. Where “Construction: withheld” appears, the technical detail is retained as filing material.
1. Post-Compromise Security without a stateful server
Research question. Can a session “self-heal” after device compromise (PCS, Double Ratchet class) without a server that stores prekeys — i.e. while keeping a deaf, stateless relay? Why it is hard. The industry standard (Signal X3DH/PQXDH) requires a semi-trusted key server; our architecture forbids it. Moreover, authenticating rotating DH keys must be done without digital signatures, so as not to break the conversation’s cryptographic deniability. Success criterion. Confidentiality recovery after compromise while keeping the stateless relay and deniability, verified as a testable property on shared vectors. Achieved (2026-07-14). Moved from design to implemented and verified as a testable property: a reference in two independent languages bound by shared vectors, plus tests, confirm confidentiality recovery after compromise while keeping the stateless, deaf relay and deniability (authentication without signatures). Limit named openly: a deliberately flagged initial phase with a weaker guarantee remains. The means of achieving it (construction) — not published. Construction: withheld (patent option kept open). Status: implemented and verified (reference + vectors + tests); integration into the live transport ongoing.
2. Post-quantum hybrid (X25519 + ML-KEM)
Research question. How to add post-quantum resistance (“harvest now, decrypt later”) to the content-protecting key exchange on mobile, without weakening today’s cryptography and without violating traffic indistinguishability? Why it is hard. ML-KEM keys/ciphertexts are large (~1.1 kB) — the handshake and QR code grow, and the handshake may exceed the metadata layer’s fixed cell. Parameter choice, FFI integration (Rust/liboqs) and two-implementation parity are open problems. Approach. A hybrid construction combining two independent secrets (classical X25519 + ML-KEM) in a single KDF via the standard combiner — secure as long as one primitive holds; additive, content-protecting roots first. (The hybrid scheme itself is state of the art and is published; specific parameter choices for the metadata layer are handled separately.) Status: design.
3. Metadata-resistance layer (mixnet / cover traffic / fixed cell)
Research question. Can traffic indistinguishability (who-talks-to-whom, when, how much) be held against a global passive observer — not only in an idealized model but for real on Android/Tor, where the leak lives in implementation detail? Why it is hard. Mixnet proofs (Loopix/Nym) assume an ideal Poisson process and bit-identical cells. The real leak lives in the gap to implementation: Android Doze, TCP retransmission, notifications. Cover traffic must be independent of real traffic — adaptive cover leaks precisely the quantity it is meant to hide. Negative result (published). The original “load-dependent cover” design was shown to be flawed: adaptive cover is trivially distinguishable, so turning the protection on singles out the user. Re-designed to a constant Poisson rate (state of the art: Loopix/Nym). A deliberately published instance of hypothesis falsification. What we publish (already disclosed in the product whitepaper). Messages are padded to fixed size buckets (the relay sees only a handful of sizes, never the exact length); an optional mode sends on a fixed cadence filling gaps with indistinguishable decoy frames; each persona rides its own Tor circuit. The limit is named openly: a global passive observer of both ends can still attempt timing correlation — the cadence raises the bar, it does not remove it. Method (published). Indistinguishability as a testable property: byte assertions, pcap diff, timing-distribution test, platform-state fuzz. Fixed-cell and fragmentation construction (cell format, fragmentation scheme, single real/dummy code path): withheld (patent option kept open). Status: partially implemented; core in design.
4. Address-less rendezvous with epoch rotation
Research question. How to deliver messages without accounts or addresses, such that the relay never knows the session selector in advance and cannot link activity over time? Why it is hard. The selector must be a capability known only to the two parties; periodic rotation creates edge cases around listen windows and findability. Originated as a response to a linkability gap found in an external review. What we publish (already disclosed in the product whitepaper). The conversation address is not a fixed handle — it is re-derived on a short clock (a new, unguessable id roughly every 15 min), and each conversation’s rotation is phase-shifted by its own shared key, so the relay cannot batch addresses into “one device”; the server keeps no per-recipient state (the client carries the cursor). Effect: a single timing correlation confirms at most one 15-min window, not the conversation’s history. Success criterion. Delivery without account/address at a relay that does not know the selector in advance and cannot link activity across epochs. Construction (selector derivation as an ECDH capability, epoch-tag mechanics, listen windows/findability): withheld (patent option kept open — direction flagged as sensitive). Status: implemented and tested.
5. Deterministic fork-healing of group epochs (coordinator-free)
Research question. How to resolve concurrent membership changes — which create a “fork” in the key history — deterministically and without a central coordinator? Why it is hard. A distributed-consensus-class problem. The standard (MLS, RFC 9420) requires an order-enforcing server; our relay is deaf, so the conflict must be resolved client-side. Success criterion. Deterministic, convergent fork resolution across all clients with no coordinator and no loss of MLS security properties. Construction: withheld (patent option kept open). Status: implemented and tested.
6. Deniable store with hidden volume (coercion resistance)
An axis orthogonal to conditional access (direction 7): this is about plausibly denying the existence of data and the duress mode, not about the unlock conditions themselves. Research question. How to achieve plausible deniability (VeraCrypt class) in a mobile, account-less store — with an automatic decoy profile and coercion (duress) resistance? Why it is hard. The existence of the hidden volume must be unprovable (equal size, always chaff); the lock header must not reveal the type of condition used (forensic leak), and changing/disabling the decoy must not break deniability. Success criterion. Unprovable existence of the hidden volume, concealment of the condition type in the header, and preserved deniability under coercion. Construction (decoy/real-slot blob, type-hiding trial, duress path): withheld (patent option kept open). Status: mechanism implemented; credibility of the duress mode unverified (open project question).
7. Conditional access with quorum: envelope of conditions (access graph)
Research question. Can a single access mechanism be built in which the key is any artifact or combination (password, file, NFC presence, K-of-N quorum of people, time delay), bound into a graph of conditions (AND / OR / threshold), while preserving the no-oracle property (wrong and missing key indistinguishable) and a deaf relay? Why it is hard. The standard binds content to one key or to a key server. Combining heterogeneous secret sources into one key — without revealing which conditions were used (that is metadata), without a hit oracle and without a server — is open. Quorum as a secret source (Shamir key-splitting) must compose with a threshold condition such that K−1 shares reveal nothing. What we publish (already disclosed in the product whitepaper). The quorum primitive (Shamir K-of-N over GF(2⁸)) and the “no oracle” property are publicly described on the product side — we restate them as background, not as new disclosure. Success criterion. One container reconciling arbitrary secret sources into an access graph, no oracle, no server; quorum composable with a threshold; zero leak of the conditions used into the cleartext header. Achieved (2026-07-14). Closed as a testable property: one container reconciles heterogeneous secret sources into an access graph with nested thresholds (AND / OR / threshold t-of-n, arbitrary depth), with no oracle at any node (wrong/missing key indistinguishable) and no server; a quorum composes as a threshold node. Verified by a test suite (including two independent access paths, recovery via OR, nested thresholds, no-oracle). Construction (format, combination mechanics) — not published. Construction (container format, carrier-gating of shares, AND/OR/threshold graph): withheld (patent option kept open — directly §2.1: “RDKV envelope of conditions”, “quorum as a secret source”). Status: implemented and tested (v1 mechanism + graph v2 with nested thresholds); construction withheld; UX integration ongoing.