← Back
Home › Systems › Security and identity

key-transparency

key transparency for messaging

CONIKS, WhatsApp key transparency

SystemTechniques · 3Primitives · 12 key-transparency Transparency logsecurity · medium: A public append-only Merkle tree whose signed heads let anyone verify an entry is present and history was only extended, with log-size proofs.›Witness cosigningsecurity · medium: Independent witnesses cosign log checkpoints so a log cannot show different views to different clientsLSM-treestorage · medium: Buffer writes in memory, flush them as immutable sorted files and merge in the background; turns random writes into sequential I/O.›Merkle treedata-structures · low: Hash tree for verifying and diffing large datasets with logarithmic proofsDigital signatures (Ed25519)security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.›Sparse merkle treedata-structures · low: Merkle tree over a 2^256 key space with default empty hashes: membership and non-membership proofsCommitment schemessecurity · low: Hash and Pedersen commitments: hide a value now, bind to it, reveal laterCryptographic hashes (SHA-2, BLAKE3)security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.›ECDH key exchange (X25519, P-256)security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.›Verifiable random functionsecurity · low: VRFs: keyed hash with a proof, used to hide directory keys while allowing verificationWrite-ahead logstorage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.›Segmented logdistributed · low: Split an append-only log into files named by their first offset, write only the newest, and find any record by binary search plus a sparse index.›CRC32C checksumshardware-os · low: The Castagnoli CRC-32 with dedicated instructions on x86 (SSE4.2) and ARMv8. It is the standard fast integrity check for storage blocks, logs and network frames.›fsync, O_DSYNC and O_DIRECThardware-os · low: What fsync, fdatasync, O_DSYNC, O_DIRECT and F_FULLFSYNC really guarantee on Linux and macOS, and the exact call sequences for crash-safe files.›SIMD programminghardware-os · low: Process 4-16 lanes per instruction with AVX2, AVX-512 or NEON via Rust std::arch, with runtime dispatch and a portable fallback.›

Similar systems

Share the most building blocks with this one.

audit-log 28 %e2e-messaging 21 %cert-transparency 19 %offline-finding 18 %supply-chain-security 15 %