X25519
Fresh agreement material is used to derive wrapping keys with HKDF-SHA-256. P-256 is retained only as an explicit compatibility fallback.
Security is enforced at the device, message, identity and node boundary.
ValkNet is designed around local private-key custody, signed encrypted envelopes, authenticated mailboxes, verifiable chain identity and master-rooted tenant trust.
Client cryptography
Ed25519
Every accepted VIX-MSG 2.3 envelope must carry a valid signature from the registered device signing key.
AES-256-GCM
Each message receives a fresh 256-bit content key and authenticated encryption metadata.
Non-exportable keys
Modern browser clients create private CryptoKeys locally and do not upload private key material.
Server enforcement
Device sessions
Inbox access and message submission require a valid device-scoped bearer session.
Deterministic message IDs
Duplicate signed envelopes are rejected and malformed authenticated metadata is refused.
VIX ↔ BIX challenge binding
BIX ownership is proven through Ed25519 challenge-response and exact address derivation.
Proof, not plaintext
VIX receives hashes, route proofs and identity anchors; message plaintext remains outside the chain.
Deployment posture
Tenant nodes are expected to operate under zero-trust assumptions with isolated services, least-privilege administration, master-key pinning, signed entitlement manifests, encrypted backups and controlled connector zones.
DEVICE → SIGN + ENCRYPT → AUTHENTICATED MAILBOX → VIXNET ROUTE → HASH/PROOF → VIX CHAIN
TENANT NODE → NODE-SIGNED HEARTBEAT → MASTER CONTROL → SIGNED ENTITLEMENT / POLICY