Client-side key generation, Elliptic Curve Diffie-Hellman session derivation, and AES-256-GCM ciphertexts
TribFi Direct Messages support full client-side End-to-End Encryption (E2EE) powered by the W3C Web Cryptography API (crypto.subtle). Key pairs are generated directly in the user's browser:
The private key is stored locally in client-side secure storage and never sent over the network. The public key is published to the user's profile via /api/messages/keys.
When two users start an encrypted conversation, their browsers derive an identical shared secret using Elliptic Curve Diffie-Hellman (ECDH). Messages are encrypted locally using AES-256-GCM with a unique 96-bit initialization vector (IV) per message.
The TribFi database and relay servers store only encrypted ciphertexts. Neither TribFi administrators, hosting providers, nor external attackers can read private messages or decrypt attachments.