Discrypt

Discrypt explores a Discord-like secure communication system where Rust owns sensitive key/media boundaries, relays route ciphertext without trusted custody, deterministic harnesses model delivery/recovery behavior, and the interface states the limits of content privacy and deletion.

Problem

Secure communication products can hide meaningful boundaries behind broad claims. Discrypt treats relays, metadata, device keys, retention, replay, recovery, admission, and deletion limits as product states instead of marketing abstractions.

Contribution

I implemented prototype code in Rust crates and a React/Tauri shell for security, media boundaries and user-facing product surfaces. Deterministic harnesses model relay routing, delivery and recovery, retention tombstones, governance and admission, push metadata, and UX safety copy.

Endpoint-Owned Security Model

Keys and sender/device/counter binding stay inside Rust-owned endpoint boundaries. Relays carry ciphertext and routing metadata rather than central trusted custody. Per-author logs, bounded recipient caches, store-forward TTLs, gossip convergence modeling, fork/downgrade/replay recovery, epoch-bound governance, admission helpers, and retention tombstones are separate concerns that the interface explains separately.

Technical Decisions

MLS-style group/key state and SFrame-like AEAD media protection with raw keys outside JavaScript

Content-blind relay overlay with deterministic ranking, failover, TTL-bound store-forward and a three-hop bound

Replay, fork and downgrade handling modeled with explicit repair rather than hidden retry

Epoch-bound governance/admission, signed state changes, invite limits and helper admission paths

Retention presets, tombstone sync and backup behavior that excludes content keys

Tradeoffs

Research correctness over premature production claims

Explicit security caveats over marketing language

Rust-owned sensitive boundaries over easier browser-only implementation

Outcome

Discrypt keeps content privacy, metadata exposure, endpoint key ownership, retention and deletion constraints visible in the application. Cooperative deletion cannot revoke screenshots, exported plaintext, modified-client copies or content already observed by a recipient.

screenshot · 1/5