Security Architecture
Security Architecture
How Semafore handles keys, sessions, encryption, and rotation.
Security architecture reference pages for Semafore.
Page
Overview
What plaintext-blind means and how the trust model works.
PageCryptographic Primitives
X25519, Ed25519, AES-256-GCM, HKDF, and HMAC-SHA256.
PageIdentity Keys
Dual identity key contract, key bundles, and per-device keys.
PageSession Establishment
X3DH walkthrough, first-message headers, and multi-device fan-out.
PageMessage Encryption
Double Ratchet, dr_v1 wire format, and forward secrecy.
PageBroadcast Messages
Organisation-wide announcements, offline delivery, and plaintext-blind relay.
PageKey Rotation
SPK rotation triggers, procedure, and why it matters.