AEGIS
How it works Run it Docs Status Source
post-quantum · metadata-resistant · deniable

A messenger where even the relays can't tell
who is talking to whom

AEGIS is an experimental secure-messaging protocol and working reference implementation. It combines hybrid post-quantum encryption, a cover-traffic mix network, a quantified web of trust, and a real desktop app — as one stack.

Get the code Read the whitepaper Run it yourself
Screenshot of the AEGIS Desktop chat interface: a dark two-pane messenger with a contact list and an encrypted conversation.

AEGIS Desktop — the reference client. It runs a local mix node and shows a chat UI in your browser.

How it works

Content security is largely a solved problem. AEGIS reuses only vetted primitives for it and spends its originality on the two harder problems — hiding metadata and establishing trust.

■ confidentiality

Hybrid post-quantum

X25519 + ML-KEM-768 for key exchange and Ed25519 + ML-DSA-65 for signatures. Secure if either the classical or the post-quantum half holds — defusing “harvest now, decrypt later”.

■ forward secrecy

Hybrid ratchet

A KEM ciphertext rides every step of a Double Ratchet, giving forward secrecy and post-compromise healing against a quantum adversary.

■ metadata

Cover-traffic mixnet

Onion routing, constant-rate cover traffic, fixed-size packets and Poisson mix delays. A global observer sees identical, constant traffic whether or not you are talking.

■ delivery

Provider mailboxes

You are never the final hop. Mail waits at a provider under a key-bound token and is released only after you sign a challenge — so knowing your ID can’t steal it.

■ trust

Quantified web of trust

Trust in an unknown key comes from k independent vouching paths, provable via an accumulator without revealing the rest of the trusted set. No central authority.

■ verification

Safety numbers

Self-certifying IDs (the ID is the hash of the keys) plus a safety number you compare out-of-band to rule out a man-in-the-middle.

Run it yourself

Python 3.11+ on Windows, macOS or Linux. Everything is local; no account, no server. Two people, each running an engine, can chat end-to-end through the mix network.

  1. Install dependencies
    pip install -r requirements.txt
  2. See the whole stack run over a live mix network in one command: 
    python net_demo.py
  3. Launch the desktop app — one per person, sharing a directory folder: 
    python aegis_app.py --name Alice --http 8001 --port 9001 --dir board
python aegis_app.py --name Bob   --http 8002 --port 9002 --dir board
  4. Open the printed link (it carries a one-time access token) in your browser, pick a contact, and start an encrypted conversation.

Prefer a terminal? python aegis_chat.py is a text client. Run python -m pytest -q to see the test suite (32 tests).

Documentation

AEGIS is documented in the open, including the things that are not done.

Whitepaper →
The full protocol design, security argument, and every stated limitation.
Technical due diligence →
Security claims stated precisely, threat model, and the known-gaps register.
Hardening checklist →
The prioritized engineering work required before an external audit.
Commercialization assessment →
Market, regulatory path, business models, and a realistic cost/timeline.

Honest status

What AEGIS is, and what it is not — because in security, overclaiming is how you lose the only asset that matters.

What works today

  • End-to-end encrypted, deniable sessions over a real TCP mix network
  • Constant-rate cover traffic, fixed-size packets, per-hop mix delays
  • Provider mailboxes with authenticated retrieval
  • Encrypted-at-rest keys; token-gated local API; signed directory
  • A working desktop app and a 32-test suite

What it needs

  • An independent cryptographic audit — the non-negotiable next step
  • Audited native PQ crypto (the current libraries aren’t constant-time)
  • A large enough user base for the anonymity set to be real
  • Mobile clients, delivery acks/retries, formal verification
  • To be treated as research, not protection, until all of the above

X25519 + ML-KEM-768Ed25519 + ML-DSA-65 ChaCha20-Poly1305Loopix-style mixnet RSA accumulatorPython 3.11+