From 66ebd574adca769de2174ebd284fe9cde331d574 Mon Sep 17 00:00:00 2001 From: pi Date: Wed, 29 Jul 2026 09:37:46 +1200 Subject: [PATCH] docs: fix subject-verb agreement in THREAT-MODEL.md --- docs/THREAT-MODEL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/THREAT-MODEL.md b/docs/THREAT-MODEL.md index bf9dc60..026f387 100644 --- a/docs/THREAT-MODEL.md +++ b/docs/THREAT-MODEL.md @@ -47,7 +47,7 @@ The app has three ways to send, and conflating them is the most likely way it ge **Channel key derivation** is scrypt (N=2^14) over the passphrase, salted with the channel name. Paid once at join and cached, so it is never on a message path. It is a compromise: it raises the cost of an offline dictionary attack on recorded traffic but does not rescue a genuinely weak passphrase. **Argon2id via a native binding is the single cheapest security upgrade available to this codebase.** -**Groups are fan-out** — one independently sealed copy per member, no group key. This means no rekeying problem and no group-membership cryptography to get wrong; removing someone is simply not sending to them. Membership is local, so two members can disagree about who is in a group. Injection is jittered over 0–3s because N envelopes leaving one device simultaneously reveals group size to an observer who cannot decrypt anything. +**Groups are fan-out** — one independently sealed copy per member, no group key. This means no rekeying problem and no group-membership cryptography to get wrong; removing someone is simply not sending to them. Membership is local, so two members can disagree about who is in a group. Injection is jittered over 0–3s because N envelopes leaving one device simultaneously reveal group size to an observer who cannot decrypt anything. ## Cryptographic design