Understanding Sylo Encryption
How Sylo keeps you safe
The Sylo Network is a decentralised communication and storage network with the performance and scalability to support millions of users. Applications use the network for decentralised, private communication, storage, and micropayments.
It is important to be able to “trust, but verify” the security of the communication tools you use. It might not be a life or death matter to you or your family, but the lives of journalists, activists, refugees, and more depend on encryption doing what developers claim it does. Everyone has something to hide. Privacy is relational.
Michael Hayden, retired United States Air Force four-star general and former Director of the National Security Agency, once said: “We kill people based on meta-data.”
Encryption matters.
Therefore please consider this article as another stepping stone on our path to open source.
Sylo encryption overview
All messages, voice calls, video calls, and file transfers on the Sylo Platform are end-to-end encrypted, which means only you and your intended recipients can see the content of what is sent.
Sylo follows the first rule of cryptography:
“Don’t roll your own crypto.”
This rule implies that instead of writing your own cryptography protocols, developers should “use published, public, algorithms and protocols.”
Cryptography is a very complex discipline and extremely important to implement correctly; one small error could open up a back door to exposing important secrets. The suggestion goes that new cryptography research projects are usually results of new requirements and built on learnings from a multitude of failures and fixes. Creating your own cryptography is probably a bad idea (if not very suspicious and unusual) when provably secure, audited, open-source options already exist. Hence, our choices at Sylo.
The Sylo Smart Wallet uses the Signal Protocol for chat messages. The Signal Protocol is an open-source cryptographic protocol with end-to-end encryption.
“The protocol provides confidentiality, integrity, authentication, participant consistency, destination validation, forward secrecy, post-compromise security (aka future secrecy), causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity.”
- Wikipedia on Signal Protocol
File transfers in the Sylo Smart Wallet also use the Signal Protocol. Having forward secrecy and end-to-end-encryption means only your contact can ever see what you send.
We use the WebRTC (“Web Real-Time Communication”) open-source library for real-time voice and video communication. WebRTC has security as a major focus, encrypting all data (voice and video) that goes through it, while also forces Sylo to encrypt signalling messages that connect contacts when they want to call.
The Ed25519 public-key pair scheme is used for all other general messaging signing — anything other than chat that is sent by a user’s device. Ed25519 digital signatures prove authorship over any content a user sends.
Sylo also follows the number one rule of cryptocurrency:
“Your keys, your crypto.”
This rule refers to the fact that if you do NOT have your crypto wallet keys, YOU do not actually have control of your cryptocurrency and/or wallet assets — whomever has your keys owns everything.
Sylo brings this a step further in that only you own your keys, only you own your chats, only you own your contacts, cloud files and dApps too! You are your own bank, Sylo simply helps you to access your encrypted private vault with your key you control.
The Sylo Network is built to enable users’ devices to connect directly (peer-to-peer) whenever possible, which means there is no ‘middle man’ snooping, other than the global internet infrastructure needed to send data.
Sylo Service Peers exist to help users connect directly, store encrypted data (they cannot read it) when a user is sent something while they are offline and will relay encrypted channels when a user’s device is in a restricted networking environment (most common when using mobile internet).
“A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.”
The Signal Protocol for chat and files
A huge win with using the Signal Protocol is “forward secrecy” which means even if one message is compromised nothing else is — each message is encrypted with new keys. The Signal Protocol is used for encrypting chat messages end-to-end which means only the person(s) you are talking to can see what you send. Your cryptographic keys used for encrypting are generated on your device and the private components are never ever shared.
Keys used to encrypt group chat messages are renewed whenever a new member joins the group — an extra layer of forward secrecy preventing the new member from reading any previous group messages. This combination of end-to-end-encryption and forward secrecy prevents the risk of compromising the entire message history if any particular key happens to be leaked.
WebRTC for voice and video
WebRTC is an “open-source project that provides web browsers and mobile applications with real-time communication (RTC) via simple application programming interfaces (APIs).”
By utilising WebRTC, Sylo must encrypt signalling messages that connect contacts when they want to call. It uses Transport Layer Security (TLS) sessions or QUIC (an improved transport layer) for its signaling transport. WebRTC encrypts all data going through it. WebRTC sends real-time audio and video over SRTP (“Secure Real-time Transport Protocol”).
Ed25519 public-key pair for other messaging
Sylo Network users are comprised of both application users and Sylo infrastructure nodes called “Service Peers”. Users are represented by Sylo ID’s, each of a user’s devices is identified by a Device ID. Both the Sylo ID and Service Peer ID are public components of an Ed25519 keypair. Ed25519 is a digital signature algorithm and is an attractive choice due to its speed and relatively small key and signature sizes.
Whenever their network environment allows it, Sylo users communicate with each other directly peer-to-peer (p2p).
User’s use their respective Sylo and Device keypairs to perform two layers of encryption ensuring their communication is secure.
The first layers relies on Libp2p’s SECIO module. SECIO is an end-to-end crypto protocol whose handshake is through ‘asymmetric crypto’. It allows two devices or users to connect even over insecure channels and verifiably know that each other are who they claim and that their messages are not tampered with.
The Sylo Protocol may also employ an additional authentication protocol, which is another handshake that verifies that a particular device is being operated by a particular Sylo user.
These two layers of encryption allow Sylo users to be confident in knowing who they communicate with and to alleviate any concerns about ‘man in the middle’ attacks. These secure P2P streams are a foundational component in the Sylo Protocol and are employed across the board, including inboxing services, relay services, ticket payment negotiation, and many more.
Sylo uses Ed25519 keypairs for signing any content that a user device sends, not just for setting up secure P2P streams. In particular, we use it to sign OpLog operations and Inbox messaging items. Ed25519 digital signatures prove authorship of any content.
BIP39 seed phrase
Sylo gives encryption key seed phrase ownership over to users as a non-custodial-wallet. You should never share your seed phrase with anyone, the Sylo Support Team will never, ever ask for it. It is absolutely vital that you back up your seed phrase and store it securely in multiple real world locations in case of disaster.
Sylo seed phrases are more than just keys to your cryptocurrency wallet. Your seed phrase is your only form of login — no email, no phone number, no password (Sylo does not want ANY of your personal data). Your seed phrase is your key to your chats, contacts, cloud files, digital assets, and dApps.
Remember — You are your own bank, Sylo helps you access your encrypted private vault and identity.
Sylo Service Peers relay data in restricted networks
When a user’s device is in a restricted networking environment (most common when using mobile internet) community run, Sylo token-incentivised Service Peers are there to help relay encrypted data.
Data relayed by Service Peers is encrypted with “SECIO” (see above for explanation), end-to-end between the two peers being relayed to each other — so no Service Peer can ever read any data that they forward.
It is a possibility in the future that Sylo users in unrestricted networks could optionally help forward encrypted traffic too in order to further broaden the relaying distribution channels.
Some last words we keep in mind when developing for our users:
“The enemy knows the system… one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them.”
At Sylo, we take your security and privacy seriously. Our development work to preserve this is a perpetual evolution.
If you have any questions, don’t hesitate to get in touch. We’d love to hear from you. You can direct enquiries to contact@sylo.io
—
Experience the Sylo Smart Wallet now by downloading from the Google Play or Apple App stores.
For further announcements, follow Sylo on Twitter, Telegram or visit www.sylo.io
