OSHI Guides — Privacy & Encryption, Explained
Welcome to the OSHI privacy & cryptography guides — plain-English explainers of the technologies that make secure, private, censorship-resistant messaging possible. Each guide defines a concept clearly, explains how it actually works, and shows where it fits in a real encrypted messenger.
These pages are educational first. We describe each technology on its own terms, then include a short, honest note on how OSHI uses it — including where OSHI does not yet deliver the property being described. You do not need OSHI to learn from them — but if privacy matters to you, OSHI is a free, open-source, Swiss messenger built on exactly these ideas.
Post-quantum key agreement: X-Wing
OSHI implements X-Wing — ML-KEM-768 combined with X25519 — through CryptoKit's XWingMLKEM768X25519, to defend against harvest now, decrypt later: traffic recorded today and stored until a quantum computer can break it. It is hybrid only, never post-quantum alone, so a future break of ML-KEM cannot leave a session weaker than it is today, and it fails closed rather than quietly downgrading. The condition belongs with the claim: the API is @available(iOS 26 / macOS 26) while the app deploys to iOS 17.5, and the policy is .hybridWhenAvailable, negotiated per conversation — so it engages only when both ends can. Full detail in end-to-end encryption.
What OSHI does not claim
Forward secrecy is not yet universal. OSHI's v3 session format performs the Diffie–Hellman ratchet; the older v2 format does not, and most of the installed base is still on v2 — the forward secrecy guide gives the full status. Metadata is reduced, not zero: on the internet path, OSHI's relay sees sender and recipient public keys, timestamps and message sizes, though it cannot read messages. Only the mesh path is serverless — Bluetooth LE and Wi-Fi, device to device, with no server involved at all. Group chat uses a shared envelope and does not carry the same guarantees as a 1:1 conversation.
Encryption & protocols
End-to-End Encryption
What E2EE means, how it differs from encryption in transit, and why only the sender and recipient can read the message.
ProtocolThe Signal Protocol
The open cryptographic protocol behind modern secure messaging: X3DH key agreement plus the Double Ratchet.
AlgorithmThe Double Ratchet
How a DH ratchet and a symmetric-key ratchet combine to give forward secrecy and post-compromise security.
CipherAES-256
The 256-bit Advanced Encryption Standard, GCM authenticated encryption, and why it is trusted worldwide.
PropertyPerfect Forward Secrecy
Why a stolen long-term key should never unlock your past conversations — and exactly how much of that property OSHI delivers today.
Privacy & metadata
What Is Metadata?
The data about your messages — who, when, how often — and why it can reveal as much as the content.
PrivacyAnonymous Messaging
What anonymity really requires, from no phone number to metadata resistance and network anonymity.
CovertSteganography
Hiding the existence of a message, not just its contents — and how it differs from encryption.
Networks & transport
Mesh Networking
How devices relay for each other to form a resilient, infrastructure-free network.
NetworkBluetooth Mesh
Messaging over Bluetooth Low Energy when there is no Wi-Fi, no cell service, and no internet.
AnonymityWhat Is Tor?
Onion routing: how layered encryption across volunteer relays hides who is talking to whom.
StorageWhat Is IPFS?
Content-addressed storage where a file's address is a hash of the file itself.
NetworkOshi Free-Dom VPN
A separate app from the messenger: a WireGuard tunnel with a filtering DNS resolver at the exit, and a per-country account of where logging is legally mandatory.
Frequently Asked Questions
What are these OSHI guides?
They are free, educational explainers of the encryption, privacy, and networking technologies used in secure messaging. Each guide defines the concept, explains how it works, and honestly notes how OSHI applies it.
Do I need to install OSHI to read them?
No. The guides are written to be useful on their own. OSHI is a free, open-source, Swiss encrypted messenger for iOS and Android that you can optionally install.
Is OSHI really open source?
Yes. OSHI is released under the MIT license and its source code is public on GitHub, so anyone can audit how it implements the technologies described here.
Private messaging, by design
OSHI is a free, open-source, Swiss encrypted messenger. No phone number, no ads, no tracking.