Report privately, not in a public issue. We would rather hear it from you than read it in a paper.

Email: contact@oshi-messenger.com Encrypt to our OpenPGP key — oshi-public-key.asc

Fingerprint  CC57 EFDF DD66 DF95 1F9C  8108 025F 383C DCCA 2600
Key ID       025F383CDCCA2600
Type         Ed25519 (sign) + Cv25519 (encrypt)
Created      2026-09-08      Expires  2029-09-07
UID          OSHI (OSHI Messenger project key) <contact@oshi-messenger.com>

Verify the fingerprint against this file over a second channel before you trust it.

The transport and the cryptography are published here and are identical to the shipping build. The areas where a finding would matter most, in order:

1. src/OSHICryptoV2.swift and src/DoubleRatchet.swift — X3DH, the ratchet state machine, AEAD and header binding, the post-quantum KEM layer.
2. src/MeshNetworkManager.swift and src/CrossPlatformMesh.swift — peer identity binding, session establishment, and active attacks by a node in radio range. This is the attack class that broke comparable products.
3. src/MeshRelay.swift — replay, amplification, and what a relayed packet discloses to a passive observer.

• Acknowledge within 72 hours.
• Agree a disclosure date with you. We do not ask for indefinite embargoes and we do not sign NDAs.
• Credit you as you wish, including not at all.
• Publish the finding and the fix, including anything we decide not to fix and why.

USD 500 critical, 250 high, 100 medium, paid from a solo developer's own pocket. Small, and honest about being small.

Anything requiring a jailbroken device, physical access to an unlocked phone, or a debugger attached to the process. Denial of service against a single device by an attacker already in Bluetooth range is in scope only where it is remote and unauthenticated.

OSHI uses military-grade encryption to protect your communications.

OSHI implements the Signal Protocol's Double Ratchet algorithm:

• Root Key Ratchet: Derives new keys after each DH exchange
• Chain Key Ratchet: Derives message keys for each message
• Forward Secrecy: Past messages cannot be decrypted if keys are compromised
• Break-in Recovery: Future messages protected after compromise

┌─────────────────────────────────────────────────────────┐
│                    Double Ratchet                        │
├─────────────────────────────────────────────────────────┤
│  Alice                                         Bob      │
│    │                                            │       │
│    │◄────────── DH Key Exchange ──────────────►│       │
│    │                                            │       │
│    ├── Root Key ──► Chain Key ──► Message Key   │       │
│    │                                            │       │
│    │    [Message 1] ─────────────────────────►  │       │
│    │    [Message 2] ─────────────────────────►  │       │
│    │                                            │       │
│    │◄─────────── DH Ratchet Step ─────────────►│       │
│    │                                            │       │
│    │  ◄───────────────────────── [Message 3]   │       │
│    │                                            │       │
└─────────────────────────────────────────────────────────┘

• Direct device-to-device via MultipeerConnectivity
• No server involvement for local communications
• Automatic peer discovery and connection

• Messages stored encrypted on IPFS
• Only recipient can decrypt
• Server never sees plaintext

• End-to-end encrypted audio
• VPS only routes encrypted blobs
• Cannot decrypt or inspect content

┌──────────────────────────────────────────────────────────┐
│                  Message Routing                          │
├──────────────────────────────────────────────────────────┤
│                                                          │
│   [Device A] ◄──── Mesh Network ────► [Device B]        │
│       │              (Direct P2P)           │            │
│       │                                     │            │
│       └──────► IPFS/VPS ◄──────────────────┘            │
│              (Encrypted Fallback)                        │
│                                                          │
└──────────────────────────────────────────────────────────┘

• Physical device access with unlocked phone
• Keyloggers on the device
• Recipient sharing messages manually
• Legal compulsion of the user

We welcome security researchers to verify our claims.

1. Review the cryptographic implementations
2. Test encryption/decryption flows
3. Verify no plaintext leakage
4. Check key management

If you find a vulnerability:

1. DO NOT disclose publicly
2. Email: security@oshi-messenger.com
3. Include: Description, steps to reproduce, impact
4. We respond within 48 hours

We offer rewards for critical vulnerabilities:

• Critical (RCE, key extraction): Up to $5,000
• High (encryption bypass): Up to $2,000
• Medium (information leak): Up to $500

// X25519 key pair generation
let privateKey = Curve25519.KeyAgreement.PrivateKey()
let publicKey = privateKey.publicKey

// Shared secret derivation
let sharedSecret = try privateKey.sharedSecretFromKeyAgreement(with: peerPublicKey)

// Key derivation with HKDF
let symmetricKey = HKDF<SHA256>.deriveKey(
    inputKeyMaterial: sharedSecret,
    salt: salt,
    info: info,
    outputByteCount: 32
)

// AES-256-GCM encryption
let sealedBox = try AES.GCM.seal(
    plaintext,
    using: symmetricKey,
    nonce: AES.GCM.Nonce()
)

// Result: ciphertext + authentication tag
let encrypted = sealedBox.ciphertext + sealedBox.tag

• No phone number required: Privacy by design
• No central account: Keys stored only on device
• Encrypted local storage: Messages encrypted at rest
• Screenshot protection: Blocks screenshots in chat
• Message expiration: Auto-delete options
• Key verification: Safety numbers for contact verification

• Website: https://oshi-messenger.org
• App Store: https://apps.apple.com/app/oshi-mesh/id6753926350
• Security Contact: security@oshi-messenger.com

Last updated: December 2024