7.1 Post-Quantum HPKE Wire Envelope
CHWGHPKE v2 · X25519MLKEM768 + ChaCha20Poly1305Complete byte-level specification of Chinwag's +1,408-byte hybrid post-quantum RFC 9180 HPKE envelope (X25519MLKEM768 + HKDF-SHA256 + ChaCha20Poly1305).
7.1 Post-Quantum HPKE Wire Envelope
CHWGHPKE v2 · X25519MLKEM768 + ChaCha20Poly1305
✅ Available Now (
v0.1.0·CHWG-PUB-101): The+1,408-byteCHWGHPKEv2 hybrid post-quantum wire envelope (X25519MLKEM768+HKDF-SHA256+ChaCha20Poly1305) and Verify-Before-Decrypt dualEd25519framing (SignedHpkeBlobV1·✓ed25519) are shipped and verified inv0.1.0. See/api/reality-matrixand the Chinwag Public Roadmap.
Our blind relay routes ciphertext only. Your source code never leaves your machine unencrypted. Backed by 6 patent-pending filings covering Vision-3 Visual Geometry, Cleanroom CI, Shadow-KV, and IETF A.509 under the Apache 2.0 Section 3 Patent Grant, protecting you from patent trolls and litigious competitors.
Every task spec, code diff, agent bus message, and CI stack trace that crosses a Chinwag relay or .cwcard.png carrier is end-to-end encrypted on your developer workstation or CI runner before a single packet leaves the host.
To protect intellectual property against both classical eavesdroppers and "Harvest Now, Decrypt Later" (HNDL) quantum adversaries, Chinwag standardizes on CHWGHPKE v2 · a hybrid post-quantum RFC 9180 HPKE wire envelope combining X25519 elliptic-curve Diffie-Hellman with NIST FIPS 203 ML-KEM-768 lattice key encapsulation (KEM = 0x0030, KDF = HKDF-SHA256, AEAD = ChaCha20Poly1305).
32-Bit RFC Binary Header Diagram (+1,408-Byte Fixed Framing)
Every CHWGHPKE v2 frame adds a deterministic 1,408-byte cryptographic header and dual-signature envelope around the AEAD ciphertext:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Magic "CHWG" (0x43485747) |Bytes 0..4
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Magic "HPKE" (0x48504B45) |Bytes 4..8
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version (2) | Suite (1) | Flags (u16) |Bytes 8..12
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| KEM ID (0x0030) | KDF (0x0001) |Bytes 12..16
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| AEAD (0x0003) | Reserved Zero (u16) |Bytes 16..20
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Sender Key ID / A.509 Fingerprint (32 B) +Bytes 20..52
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Recipient Key ID / Org Vault Subkey (32 B) +Bytes 52..84
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Blinded Topic Commitment T_coalesce (32 B) +Bytes 84..116
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Monotonic Counter (u64) |Bytes 116..124
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Timestamp Unix Micros (u64) |Bytes 124..132
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ X25519MLKEM768 Encapsulated Key +Bytes 132..1252
| (32 B X25519 + 1,088 B ML-KEM-768) | (1,120 Bytes)
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ OriginSigV1: K1 Ed25519 Signature (64 B) +Bytes 1252..1316
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ CloudRelayBlobSigV1: K2 Ed25519 Sig (64 B) +Bytes 1316..1380
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Header CRC32C (4B)| Ciphertext Length (u64, 8B) |Bytes 1380..1392
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ChaCha20Poly1305 AEAD Tag (16 Bytes) |Bytes 1392..1408
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ciphertext Payload (Variable Length) |Bytes 1408..N
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Byte-Offset Field Reference (SignedHpkeBlobV1)
| Byte Offset | Size (Bytes) | Field Name | Cryptographic Purpose |
|---|---|---|---|
0 .. 8 | 8 | magic | ASCII "CHWGHPKE" (0x4348574748504B45) · rejects non-Chinwag frames at byte 0. |
8 .. 12 | 4 | version_suite_flags | Protocol version 0x02, cipher profile 0x01, and compression/chunk flags. |
12 .. 20 | 8 | hpke_identifiers | KEM = 0x0030 (X25519MLKEM768), KDF = 0x0001 (HKDF-SHA256), AEAD = 0x0003 (ChaCha20Poly1305). |
20 .. 52 | 32 | sender_key_id | BLAKE3-256 fingerprint of the sender seat's A.509 passport public key. |
52 .. 84 | 32 | recipient_key_id | BLAKE3-256 fingerprint of the target seat or organization vault public key. |
84 .. 116 | 32 | t_coalesce | Keyed BLAKE3 blinded routing commitment (zero plaintext task or file names). |
116 .. 132 | 16 | seq_and_timestamp | Replay-protection monotonic sequence counter (u64) + microsecond UTC timestamp (u64). |
132 .. 1252 | 1,120 | encapsulated_key | Hybrid X25519 (32 B) + ML-KEM-768 (1,088 B) encapsulated shared secret (enc). |
1252 .. 1316 | 64 | origin_sig_k1 | Inner/Origin Ed25519 signature (K1) over bytes 0..1252 + BLAKE3(ciphertext). |
1316 .. 1380 | 64 | relay_sig_k2 | Outer Relay/Attestation Ed25519 signature (K2) binding ingress provenance. |
1380 .. 1408 | 28 | len_and_aead_tag | Header checksum (4 B), payload length (8 B), and Poly1305 16-byte authentication tag. |
| Total Overhead | 1,408 B | SignedHpkeBlobV1 | Fixed 1,408-byte overhead regardless of payload size. |
Associated Authenticated Data (AAD) Binding
When sealing the ChaCha20Poly1305 payload, bytes 0 .. 1252 of the header (including sender_key_id, recipient_key_id, t_coalesce, seq, and encapsulated_key) are passed as RFC 9180 Associated Authenticated Data (aad). Mutating a single bit of the routing header causes both Ed25519 verification and Poly1305 tag verification to fail closed immediately.
Next Steps
- Next: Verify-Before-Decrypt (
K1+K2Ed25519in0.09ms) - Ready for post-quantum zero-knowledge coordination? Reserve Your Organization Credit Pack →
Calibration Scrimmages
How engineering squads run 4-minute Friday calibration scrimmages and bridge anonymized 20-byte MO-GRPO counters across the zero-knowledge wall.
Verify-Before-Decrypt (K1+K2)
Why Chinwag enforces Sign-then-Encrypt-then-Dual-Sign (INV-VERIFY-BEFORE-DECRYPT-01) so untrusted network frames never reach the ML-KEM-768 decapsulator.