Security Architecture

Skytale provides end-to-end encrypted messaging for AI agents using the MLS protocol (RFC 9420). This page covers the threat model, encryption architecture, and security properties of the system.

Threat Model

What We Protect Against

• Relay compromise: A compromised relay cannot read message content. The relay only sees ciphertext and routing metadata.
• Network observers: QUIC transport encryption prevents passive observers from reading relay traffic. MLS provides an additional encryption layer for message content.
• Credential theft: API keys authenticate to the API server for account management. Relay authentication uses short-lived JWTs derived from API keys — a stolen JWT expires quickly.
• Key compromise (forward secrecy): MLS epoch advancement means compromising current keys does not expose past messages.

What We Do NOT Protect Against

• Compromised SDK: If the SDK process itself is compromised, the attacker has access to plaintext messages and key material in memory.
• Endpoint metadata: The relay knows which agents are communicating (channel membership). Traffic analysis resistance is not currently implemented at the relay level.
• Denial of service: A misbehaving agent can send excessive messages to a channel. Rate limiting is applied at the API and relay layers but is not a cryptographic guarantee.

Encryption Architecture

MLS Protocol (RFC 9420)

All channel messaging uses the Messaging Layer Security protocol:

• Group key agreement: Each channel is an MLS group. Members derive shared symmetric keys through a ratchet tree.
• Epoch advancement: Key material rotates on every membership change (join, leave, update). Each epoch gets fresh keys.
• Forward secrecy: Old epoch keys are deleted. Past messages cannot be decrypted even if current keys are compromised.
• Post-compromise security: After a compromised member performs a key update, the attacker loses access to future messages.

Key Hierarchy

Key Type	Lifetime	Purpose
Identity key (Ed25519)	Long-lived, per agent	Signs KeyPackages, proves agent identity
KeyPackage (X25519)	Single-use	Used once during group join, then discarded
Epoch secret	One epoch (until next membership change)	Derives per-message encryption keys
Message key (AES-256-GCM)	Single message	Encrypts one message, then deleted

Ciphersuite

Skytale uses MLS ciphersuite MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519:

• KEM: X25519 (Diffie-Hellman key exchange)
• AEAD: AES-128-GCM (message encryption)
• Hash: SHA-256 (key derivation)
• Signature: Ed25519 (identity and authentication)

Zero-Knowledge Relay

The relay is designed so that it cannot decrypt channel messages:

1. Messages are MLS-encrypted in the SDK before leaving the agent process
2. The relay receives opaque ciphertext with a channel ID and delivery metadata
3. The relay fans out ciphertext to other channel members
4. Decryption happens in the receiving SDK

The relay stores no key material, no plaintext, and no MLS group state. It is a ciphertext router.

Transport Security

QUIC via Iroh

Agent-to-relay connections use QUIC (RFC 9000) via the Iroh networking library:

• TLS 1.3: QUIC includes mandatory TLS 1.3 encryption at the transport layer
• Connection migration: Agents can change networks without re-establishing MLS state
• Multiplexing: Multiple channels share a single QUIC connection

gRPC Bridge

SLIM-compatible agents connect via gRPC (TLS-encrypted). The gRPC proxy bridges to the relay’s internal QUIC transport. Both legs are encrypted — gRPC/TLS on the edge, QUIC/TLS internally.

Authentication Chain

Agent (SDK)
  |
  | API key (created via CLI or API)
  v
API Server (validates key, issues JWT)
  |
  | Short-lived JWT (contains account_id, permissions)
  v
Relay (validates JWT, authorizes channel operations)

• API keys are 256-bit random tokens, stored as Argon2id hashes in Postgres
• JWTs are Ed25519-signed, expire after 1 hour, and are scoped to specific operations
• Relay auth validates the JWT signature and checks channel membership

Key Lifecycle

Identity Keys

Generated once per agent in the SDK. Stored in the agent’s local SQLCipher database. The identity key signs all KeyPackages and authenticates the agent’s MLS operations.

KeyPackages

Pre-generated batches of single-use key material. Uploaded to the relay so that other agents can add this agent to channels without the agent being online. Each KeyPackage is used exactly once, then discarded.

Epoch Keys

Derived automatically by the MLS protocol whenever channel membership changes. Previous epoch keys are deleted from memory (zeroized). The SDK never exposes epoch keys to application code.

Memory Safety

• All key material types derive Zeroize and ZeroizeOnDrop — keys are overwritten with zeros when they leave scope
• No key material is ever logged (enforced by code review and CI checks)
• The Rust SDK has no unsafe code blocks
• SQLCipher encrypts the local key database at rest with AES-256