elqio

The protocol

Five strengths, each specified before being coded, each verifiable. The diagrams are exact: what they show is what the code does.

1 / 5

End-to-end encrypted, post-quantum, no backdoor.

An ELQIO message is encrypted on the sender's device and decrypted on the recipient's. In between, relays, operator, network and observers only see an opaque block. There is no service key, no exceptional access: there is nothing to hand over to anyone.

Hybrid: two methods, only one has to hold

The key exchange combines a classical elliptic curve, X25519, and a post-quantum mechanism, ML-KEM-768, in the X-Wing construction. If one of them were broken, by a quantum computer or by a discovered flaw, the other still protects the message. Signatures are composite in the same way: Ed25519 and ML-DSA-65, together.

Built to change

Every message carries the number of its cryptographic suite. The current suite is called ELQIO-1. An ELQIO-2 suite will be able to replace it without a break: devices recognise the suite of a message and know whether they can read it.

Down to the relays

Links between relays use TLS 1.3 with a hybrid X25519MLKEM768 exchange, mandatory: a relay that does not support it is not accepted into the network.

Suite
ELQIO-1 (number 0x01)
Key exchange
X-Wing = X25519 + ML-KEM-768 (FIPS 203)
Signatures
Ed25519 + ML-DSA-65 (FIPS 204)
Encryption
ChaCha20-Poly1305
Hashing, derivation
SHA-256, HKDF-SHA-256
Between relays
TLS 1.3, X25519MLKEM768, mandatory
Libraries
libcrux, RustCrypto. Audited only. No home-made crypto.
End-to-end encryption A message becomes an opaque block on the sender's device, passes three relays and an observer without ever opening, and is readable only on the recipient's device. A clock marked 2040 is crossed out: what is recorded today stays unreadable. hello sender encrypted here relays: opaque block, never opened operator, network, observer ■■■■■■■■ hello decrypted here recipient 2040 recorded today, still unreadable tomorrow ELQIO-1 : X-Wing (X25519 + ML-KEM-768) · Ed25519 + ML-DSA-65 · ChaCha20-Poly1305
Two people, a message that becomes an opaque block right on the device, crosses everything, opens only on arrival. The "2040" clock is crossed out: recording now will not allow decrypting later.
2 / 5

Metadata anonymity: who talks to whom is known to nobody.

Encrypted content does not protect from everything. Knowing that two people write to each other, at what time, how often, is often enough to understand. ELQIO treats that metadata as part of the message to protect.

Three relays, three layers

Each circuit goes through a guard relay, a middle relay and an exit. The message is wrapped in three layers of encryption; each relay removes its own and knows only the previous relay and the next. The guard stays the same for about a month, which limits the number of relays that see a client's IP address.

Fragments, not messages

A message is split into redundant fragments by an erasure code, deposited in pseudonymous mailboxes on several storage relays. A part of the fragments is enough to rebuild the message. Mailbox labels are derived from the session and change: the storing relay does not know who owns a box.

Proven, not claimed

No relay sees a client's IP address and a mailbox label together. This property is checked by an automated non-linkability proof, replayed at every demonstration on the logs of all relays of the network.

Metadata anonymity A message is split into redundant fragments, wrapped in three layers of encryption, and passes a guard relay, a middle relay and an exit; each relay removes one layer and knows only its neighbours. Fragments are deposited in pseudonymous mailboxes on several relays. From outside, the traffic is only a row of identical blocks. message fragments redundant guard peels layer 1 middle peels layer 2 exit peels layer 3 7F2AC19D3B6E pseudonymous boxes rotating labels seen from outside uniform noise: no relay sees the IP address and the identity together Each relay knows only the previous and the next one.
A message burst into fragments, three envelope layers peeled at each relay, boxes with changing labels. The outside observer sees only uniform noise.
3 / 5

Verifiable, revocable identities, with no access to content.

Each person owns a unique identifier, published in a registry of signed events, chained to one another and replicated. Anyone can verify that an identifier is authentic and has not been modified.

E3Q9-6FYS-FRWF-KQRZ-JEV2-ZC50-J78Y-KEKS

An identifier fits in 20 bytes: a version, a 16-byte address and a 3-byte checksum, written as 32 characters in groups of four. The alphabet leaves out I, L, O and U so that nothing is confused when reading it aloud. An identifier always starts with E. As a link, it is written elq:E3Q9-6FYS-….

Revoking is not reading

An account can be revoked, for criminal use or by court decision. A revocation event is added to the registry and the network stops relaying that identity's messages. This never opens access to what was written: no key exists for that. Revocation is a public, verifiable act, like publication.

Verifiable, revocable identities A registry of signed events, chained to one another and replicated across several copies. An identity is published there, then marked revoked by a later event; the network stops relaying its messages. Beside it, a closed lock: message content stays inaccessible. Revoking is not reading. Registry of signed events, chained, replicated. #4F1A…#9C03…#E27B…#51D8… eventpublicationeventrevocation signedE3Q9-6FYS…signedE3Q9-6FYS… E3Q9-6FYS FRWF-KQRZ… E3Q9-6FYS FRWF-KQRZ… REVOKED the network stops relaying content still sealed replicated copies, anyone can verify Revoking is not reading.
A signed chain registry, a "revoked" seal on an identity, a content lock that stays closed.
4 / 5

The stamp: an anonymous business model.

A service that sells neither advertising nor data has to be paid for some other way. ELQIO goes back to the oldest model of correspondence: the stamp. Every deposit on the network costs one stamp.

Signed without seeing

The stamp is bought from the operator, but blind-signed: the operator signs a stamp it does not see, as one would sign through an opaque envelope. The relay can then check that the signature is valid, without anyone being able to link that stamp to its buyer. The operator knows it sold a hundred stamps, never which one was used by whom.

Bought through the anonymous network

The purchase itself goes through the anonymous network, within a session, and not through an identifiable connection. No purchase is made by direct connection any more. Every guard relay publishes a signed daily count of the stamps it accepted: the network's accounting can be checked, no relay can deny a figure, and nothing about the correspondence is revealed.

The local radio network, from box to box, stays free.

Signature
Blind RSA-2048 (RSABSSA, RFC 9474)
Unit
One stamp per deposit
Purchase
Through the anonymous network, per session
The blind-signed stamp On the left, the operator signs a stamp slipped inside an opaque envelope: it signs without seeing. In the centre, the stamp out of the envelope, with perforated edges, carries the valid signature. On the right, a relay checks the signature and accepts the deposit. The operator knows it sold a hundred stamps, never which one was used by whom. operator sells stamps opaque envelope the operator signs without seeing signed · valid one message = one stamp relay verifies, accepts the purchase itself goes through the anonymous network A hundred stamps sold. Which one was used by whom: unknown. RSA-2048 blind (RSABSSA, RFC 9474) · no advertising, no data exploitation
An old-fashioned stamp, revisited, signed under an opaque envelope: the signer signs without seeing.
5 / 5

Transport independent, resilient.

An ELQIO message is a binary block, designed to the bit to fit in a LoRa radio frame. What fits in the slowest radio gets through everywhere else.

Why 48 bytes

The most robust LoRa payload in Europe, at 868 MHz with spreading factor 12, is 51 bytes. Three bytes go to the radio mesh header, 48 to the fragment. A Compact fragment is therefore exactly 48 bytes, 35 of them data, and passes over any LoRa module, even the slowest. An Extended fragment, for networks with good throughput, is 960 bytes, 947 of them data.

Four routes

  • Internet, through the network's relays.
  • LoRa radio hop by hop, through home boxes relaying from roof to roof.
  • An audio signal encoded over a plain phone line, in the spirit of modems and fax.
  • Satellite, through a partner operator, where nothing else gets through.

If one channel fails, another takes over. Deferred delivery is a normal case of the protocol, not a failure: a message waits in its mailbox as long as it takes.

Relays that hold

Relays update themselves from threshold-signed releases, that is, signed by several maintainers at once, and reproducible builds, which anyone can recompile and compare. The core is written in Rust, without system allocation, so that it also runs on the embedded targets of the boxes.

Transport independent The same 48-byte block leaves from the left and arrives identical on the right by four routes: Internet fibre, LoRa radio waves relayed from roof to roof, an audio signal over a phone line, and a satellite, through a partner operator. If one route fails, another takes over. 48 bytes 48 bytes identical Internet LoRa radio, roof to roof audio signal over a phone line satellite, partner operator one channel fails
The same block travels four routes, fibre, radio waves between rooftops, a phone call, satellite, and arrives identical.

Two message profiles, and a third mode.

ProfileContentTransportsStatus
CompactShort text, maximum protectionAll: radio, audio, Internetin service
RichLong texts, images, files, deferred voiceNetworks with good throughputin service
Real timeEncrypted point-to-point video callNetworks with good throughputin service

Status and specifications

The protocol, identity, the relay network, stamps and their anonymous purchase, the four transports, the three profiles, the apps and the devices are specified, coded in Rust and in service, in "stamp required" mode with mandatory hybrid TLS. The network describes what runs and how it is verified.

The code and the specifications are not public. Reviewers get access on request; all design decisions are written and dated. To review the specifications: contribute.