Encrypted Communications Infrastructure

2.1 DTLS-SRTP Overview

Calls use DTLS (Datagram Transport Layer Security) for key exchange and SRTP (Secure Real-time Transport Protocol) for media, through the WebRTC stack on each device. The two devices perform the handshake, and our servers carry the signalling. The resulting SRTP keys stay on the devices. The WebRTC stack negotiates the cipher; we do not set one.

2.2 Per-Call Keys

Each call runs a fresh DTLS handshake, so each call has its own keys.

Calls are voice or video, one-to-one or in a group of up to 8 people. In a group call each person connects directly to every other person, so each pair has its own keys, and the signalling that carries the key fingerprints is itself end-to-end encrypted. If a network blocks the direct route, the encrypted media passes through our relay, which cannot read it.

2.3 Signalling

Call setup travels through our homeserver over TLS. Who called whom, and when, is visible to our servers. We do not yet offer a setting to limit how long that is kept.

3.1 Olm and Megolm

VoicePro Secure is built on the open Matrix protocol. Message content in a chat is encrypted with Megolm, a sender ratchet, and this holds even for a chat between two people. Olm, an implementation of the Double Ratchet, carries the Megolm keys between devices. The app uses the Matrix Rust crypto library, whose Olm and Megolm implementation (vodozemac) was independently audited by Least Authority in 2022. We have not commissioned an audit of our own app.

3.2 Initial Key Exchange (3DH)

Olm sessions start with a Triple Diffie-Hellman (3DH) exchange over Curve25519, using a long-lived identity key and single-use one-time keys. One-time keys are uploaded to the homeserver, so a session can start while the other person is offline.

3.3 What the Ratchets Provide

Each message derives its own key, and the ratchet moves forward with every message. This provides:

• No key reuse: each message is encrypted with a unique key.
• Partial forward secrecy on message content: a compromised Megolm ratchet value can expose that message and later ones until the session is re-keyed, but not earlier ones.
• No post-compromise security on Megolm by itself. Sessions are re-keyed on membership changes and periodically to bound the exposure of any single key.
• Full forward secrecy and break-in recovery apply only to the Olm sessions that carry keys between devices, not to message content.

3.4 Media

Photos and voice notes are encrypted on the device before upload, and our servers store the ciphertext. Other kinds of file cannot be sent yet.

3.5 People Outside VoicePro Secure

VoicePro Secure works only between its users. There is no SMS fallback.

3.6 Group Chats

A group chat uses the same encryption. When someone leaves or is removed the keys change, and a new member cannot read messages sent before they joined. Our servers can see the group's name and who is in it.

5.1 Lawful Requests

Our servers hold message content only as ciphertext and do not hold the keys to it, so we cannot produce readable past messages from our servers. We can produce metadata, subject to lawful authority. In the VoicePro app we can sign in to a user's account, so we do not claim that we could never be required to act on one. Key escrow is not available.

The UK Investigatory Powers Act 2016 also provides for Technical Capability Notices. Any such notice would be assessed with counsel at the time, within the review mechanisms the Act provides. This section will be extended after formal counsel review.

6.1 In Scope

Content is protected from network interception and from carriers in the path. A copy of our message store yields only ciphertext. Key backups on our servers are encrypted with a key we do not hold.

Emoji verification lets two people check each other's keys, and a verified person whose keys change is flagged. Once the 24 words are set, a device added without them, even by our own server, receives no new message keys, and what it sends is not accepted from that account (tested against a real homeserver playing that part).

6.2 Out of Scope

These limits apply today.

• Account control in the VoicePro app: our backend can sign in to an app user's account on a new device. Until the user has set their 24 words, that device could receive new messages. After that it receives no new message keys. The app offers no way to replace lost words. Someone controlling our backend could still replace a user's keys, and people who verified them would be told.
• Web delivery: the app is served from our website each time it opens. A party able to change that page, including under a legal order, could get round the encryption.
• Unverified people: until two people compare emoji, neither can be sure of the other's keys. Verification is available, not forced.
• Lost words: a device still signed in keeps working and a new one can only be approved from it. We cannot reset them.
• Alerts: Secure rings and alerts only while it is open. There is no background push.
• Metadata: who talks to whom, when and from what IP address is visible to our servers and is not concealed by content encryption.
• Endpoint compromise: spyware, a malicious application, or physical access to an unlocked phone can read content after it is decrypted on the device.
• Group forward secrecy: Megolm provides only partial forward secrecy and no post-compromise security by itself (Section 3.3).
• PSTN and standard SMS: calls and messages on the public telephone network are not end-to-end encrypted. The VoicePro dialer does not use VoicePro Secure.