What
The l2ps-poc messaging tab was a transport test — it base64-wrapped the body into the server's { ciphertext, nonce, ephemeralKey } envelope with random fillers, not real encryption. This makes it real end-to-end encryption.
How — l2ps-poc #5
- New
src/crypto/e2eMessaging.ts: seal each message to the recipient's identity ed25519 key — ed25519 → X25519, a per-message ephemeral keypair, ECDH → HKDF-SHA256 → AES-256-GCM. The recipient's public key IS the encryption key (no key exchange); the server relays ciphertext only.
useMessaging: seal on send, decrypt inbound with the wallet's ed25519 key.- Review fixes: hash the ciphertext (not plaintext — metadata leak), non-fatal key read, ordered async decrypt.
Libsodium-style sealed box: real per-recipient confidentiality, no forward secrecy vs the recipient's long-term key (a ratchet is the follow-up).
Status
DevOps
Confirm (a) the l2ps-poc frontend is deployed (URL), and (b) the target node runs the messaging server: L2PS_MESSAGING_ENABLED=true, port 3006 reachable over wss.
Links
What
The l2ps-poc messaging tab was a transport test — it base64-wrapped the body into the server's
{ ciphertext, nonce, ephemeralKey }envelope with random fillers, not real encryption. This makes it real end-to-end encryption.How — l2ps-poc #5
src/crypto/e2eMessaging.ts: seal each message to the recipient's identity ed25519 key — ed25519 → X25519, a per-message ephemeral keypair, ECDH → HKDF-SHA256 → AES-256-GCM. The recipient's public key IS the encryption key (no key exchange); the server relays ciphertext only.useMessaging: seal on send, decrypt inbound with the wallet's ed25519 key.Libsodium-style sealed box: real per-recipient confidentiality, no forward secrecy vs the recipient's long-term key (a ratchet is the follow-up).
Status
tsc -b+vite build+eslintclean.DevOps
Confirm (a) the l2ps-poc frontend is deployed (URL), and (b) the target node runs the messaging server:
L2PS_MESSAGING_ENABLED=true, port 3006 reachable over wss.Links