Security, with explicit boundaries.

01 / Threat model

The relay should not need plaintext to deliver a message.

The primary objective is to keep message and attachment plaintext, Signal private material, and decryption keys out of the Gateway, database, object storage, and Cloudflare release layers. Those systems process encrypted payloads and limited routing, timing, and retention metadata.

Ares still uses servers for asynchronous delivery. The security claim is not that servers do not exist; it is that delivery infrastructure is not designed to possess the content keys required to read the conversation.

02 / Security boundary

Plaintext becomes ciphertext on the Android endpoint.

Messages

Channel-scoped Signal state provides end-to-end encrypted message transport. Each Channel separates member identity, mailbox, invitation capability, Signal identity and session state, and ACK signing material.

Attachments

Each file uses a random 32-byte key and 12-byte nonce for AES-256-GCM streaming encryption. File name, MIME type, key, nonce, and digest are carried inside the E2EE envelope; private object storage receives opaque ciphertext.

Local state

Flutter and native Signal data are stored in Vault-specific SQLCipher databases. Database keys are wrapped by non-exportable Android Keystore AES-GCM keys; ACK private keys remain in non-exportable Android Keystore Ed25519 keys.

03 / Compartmented identity

No phone number, email address, or global user profile.

A display name exists inside a Channel, but Ares does not create a central account that naturally links identities across every Channel. Local aliases can change how another member appears on one device without rewriting that member’s own Channel name.

Optional FCM introduces installation-level metadata: Google and push infrastructure can observe an app installation token and wake-delivery events. FCM does not carry Channel IDs, message IDs, senders, previews, or attachment metadata.

04 / Onion transport

Tor is transport infrastructure, not a browsing feature.

• Production accepts an approved .onion endpoint.
• The SOCKS path preserves unresolved hostnames to avoid local DNS resolution.
• The Gateway application listener is bound behind the persistent v3 Onion Service.
• When Tor or the Gateway is unavailable, messages remain in the local queue.
• Production does not silently retry against a clearnet API.

05 / Relay retention

A durable local commit is the start of relay deletion.

1. The receiving device obtains and decrypts ciphertext.
2. Message or file state is durably committed to encrypted local storage.
3. The device sends an ACK signed for the recipient mailbox and ciphertext digest.
4. The Gateway verifies the signature, recipient, and digest.
5. Database and object-ciphertext deletion begins; a limited idempotency tombstone may remain temporarily.

Undelivered ciphertext is configured to expire from server-received time after a maximum of 48 hours. The exact production configuration and deletion paths have been checked; a 48-hour wall-clock wait has not been recorded for this release.

06 / Device controls

Controls continue inside the endpoint.

Primary and Secondary Vaults

Separate SQLCipher databases and Android Keystore wrapping keys provide two operable workspaces on one device.

Format Passcode

Invokes Android application-data clearing to remove local Channels, records, files, encrypted databases, and keys. This action cannot be undone.

Screenshot Block

Uses Android secure-window controls to restrict normal screenshots, screen recording, and recent-app thumbnails. It cannot stop an external camera or a compromised operating system.

Protected files

Requires original-sender approval before an in-app protected file can be exported. Approval does not prevent later disclosure from the recipient endpoint.

07 / Verification status

Current status: production partially verified.

Public release evidence

• Release manifest
• SHA256SUMS
• CycloneDX release file — dependency coverage remains incomplete
• in-toto provenance

08 / Known limitations

What the current design does not protect.

• Rooted, infected, or maliciously administered endpoints
• External cameras and recipients who copy or retransmit plaintext
• Counterparties who present a false real-world identity
• Advanced traffic-correlation by a global observer
• Installation-level metadata when optional FCM is enabled
• Commercial availability guarantees on the current free-tier and single-server infrastructure
• Unbounded large-group scale

Google Play publication, an independent security audit, complete dependency SBOM coverage, and corresponding-source and license distribution remain pending.

Download signed APK