Dead Drop

Dead Drop is a secure, private and metadata-free communication platform, designed to work anywhere in the world.

---

How it works:

Your device will generate new unique cryptographic keys used to securely communicate with every different person you meet.

To communicate, you will need to come face to face with another user in person and verify each other's identity, and then scan each other's aztec code to exchange public keys and add one another to your respective contact lists. This face-to-face verification prevents impersonation attacks and ensures you're communicating with who you intend to.

Once added to each other's contact lists, you can securely message and call anywhere.

For your privacy and security, you can only receive messages or calls from users that are in your contacts list, or from users in groups you have been added to. If you are not in possession of a public key for a particular user, you cannot receive their messages or call requests, eliminating unknown spam and/or malicious messages.

Dead Drop allows you to make group chats, with the option to message anonymously with others, utilising rapidly rotating identity keys and no metadata retention.

Worried if you are speaking on a private line? Dead Drop's encrypted calls will share if the other users on a call are using their speakerphone or any Bluetooth devices so you can talk in confidence!

Enjoy communicating securely within your own private group of trusted contacts by exchanging keys in person!

---

Cryptography and Privacy details:

- The app uses X25519 keys for your own identity.
- An authenticated HPKE ratchet is used to generate a unique symmetric base key after every back and forth message exchange via X25519, with SHA256 as an encapsulation mechanism and SHA512 HKDF for key derivation.
- Symmetric keys are ratcheted using a SHA512 HKDF, ensuring that each message is sent with unique keys.
- Every message exchange, your base public key forming your identity will update, providing ultimate anonymity between devices.
- The double ratchet mechanism provides perfect forward secrecy and post compromise security to all conversations on Dead Drop.
- Messages and calls are end-to-end encrypted using the ChaCha20-Poly1305 AEAD cipher.
- Dead Drop has no knowledge of who you are communicating with, or what is being sent between devices.
- Dead Drop's servers act as a Dead Drop location, where your encrypted messages can be left for the other device to pick up within 30 days. Once retrieved, the message or attachment is deleted from our servers, with no logs retained. If a message or attachment isn't retrieved within 30 days, it's permanently deleted with no trace.
- You can be added into groups with people that are not on your contact list, but only by trusted people in your contact list.
- Notifications delivered to Apple Push Notification or Firebase Cloud Messaging services contain no private or identifiable information regarding who your notification is from, or what it is about.
- All information is stored on your device with a unique cryptographic key that is protected by your device's secure enclave.