Communicationbeyondcompromise
Lumes is an end-to-end encrypted messenger built for an adversarial threat model — forensic extraction, active MITM, compromised peers, memory dumps. Twelve independent layers. Post-quantum dual signing. No telemetry. Built for users who need real security, not marketing.
Built for users that need real security,
not marketing.
Lumes's threat model assumes a sophisticated attacker — UFED extraction, active MITM, peer compromise, RAM dump. That depth is overkill for casual messaging. It's table-stakes for the people below.
Journalists & investigative reporters
Source protection at the device level. If a phone is seized, Keychain extraction yields opaque envelopes — useless without the PIN.
Activists & human rights defenders
Coordination in surveillance-heavy environments. Duress PIN silently wipes state; disappearing messages erase the symmetric ratchet, not just the plaintext.
Security researchers & high-risk individuals
Verifiable primitives. 12 independent layers — break one, the others hold. SecureString in memory; signed WebRTC with anti-replay 30 s.
Three things no
mainstream messenger does.
Dual signing with
ML-KEM-768 +
ML-DSA-65.
Classical X25519 + Ed25519 stay. Post-quantum lattices ride alongside — break one family, the other holds. The first messenger to ship FIPS 203 / 204 in production.
// handshake.ts const classical = x25519.scalarMult(ourSecret, theirPub); const pq = mlKem768.encap(theirPQPub); // FIPS 203 const root = hkdfSha512("lumes-v1-rk", concat(classical, pq.shared)); const sigC = ed25519.sign(transcript, ourEdSk); const sigPQ = mlDsa65.sign(transcript, ourDsaSk); // FIPS 204 // both signatures verified — break one family, the other holds.
Keychain extraction without the PIN yields noise.
Argon2id envelopes wrap every long-term secret. UFED can read the Keychain — it cannot unwrap it. The PIN never leaves the device.
7f 3a c1 88 e2 04 9b 14 … d6 71 0a fe c9 22 b3 5c
b8 0c d3 41 27 ee a9 6d … 4e 80 1b 97 22 c4 31 ff
→ indistinguishable from random; ≥ 2^96 work to brute-forceDisappearing messages that actually disappear.
Most apps delete the plaintext. Lumes zeroes the message key, the prekey, and the group symmetric key. Past sessions can't be reconstructed even if the device is later seized.
Twelve independent layers.
Break one — the others hold.
Each layer assumes the one above it has failed. The full chain is verifiable from the open primitives down.
Pick an attack.
See what Lumes does about it.
Every line below is in the production code. No "future work", no hand-waving. If a vendor claims a defense, we expect the same level of detail.
Cellebrite UFED, GrayKey, physical seizure.
Forensic tools dump the iOS Keychain and Realm DB byte-for-byte. With most messengers, that's a full extract. With Lumes, what they get is unwrappable opaque ciphertext.
- → Every long-term secret wrapped in Argon2id envelope (m=64 MiB, t=3)
- → PIN-bound; PIN never written to disk, never leaves device
- → 4 independent PIN-enforcement layers on every unwrap
- → Brute-force cost ≥ 2^96 with current Argon params
extracting keychain.................... ok extracting realm.db.................... ok parsing lumes.identity.................. opaque parsing lumes.prekey.bundle............. opaque parsing lumes.session.ratchet........... opaque // raw bytes of lumes.identity 00000000 7f 3a c1 88 e2 04 9b 14 d6 71 0a fe c9 22 b3 5c 00000010 b8 0c d3 41 27 ee a9 6d 4e 80 1b 97 22 c4 31 ff 00000020 2a 9f 67 03 11 d8 50 ee 63 a4 7c 8b 19 f2 06 c1 ... entropy = 7.998 bits/byte → argon2id-wrapped · indistinguishable from random → recovery requires PIN; PIN not in dump
Send a message.
Here's what happens.
- 01Handshake
X25519 + ML-KEM-768 encapsulation. Both shared secrets feed HKDF → root key.
~12 ms - 02Sign & verify
Ed25519 + ML-DSA-65 dual signature over the transcript. Both must verify.
~8 ms - 03Ratchet step
Full Signal-style Double Ratchet, 3-step: DH out, chain advance, message key derive.
~3 ms - 04Encrypt & seal
ChaCha20-Poly1305 AEAD. Sealed envelope; sender identity hidden from relay.
~1 ms - 05Send
TLS 1.3 with cert pinning. Server sees ciphertext + recipient hash; nothing else.
net
Mockup — actual UI pending public release
What other messengers
don't ship — yet.
We compare against the strongest, not the weakest. If we can be honestly outperformed on a row, we mark it.
| Capability | Lumes | Signal | Threema | Telegram | |
|---|---|---|---|---|---|
Post-quantum dual signing ml-kem-768 + ml-dsa-65 | ● | PQXDH only | ○ | ○ | ○ |
Anti-UFED envelopes argon2id PIN-bound | ● | ○ | ○ | ○ | ○ |
Anti-memory-dump (SecureString) heap-zeroing on use | ● | ◐ | ○ | ○ | ○ |
Disappearing — FS key wipe mk + prekey + gsk | ● | ◐ | ◐ | ◐ | ○ |
Duress PIN · silent wipe bypass USB/custody | ● | ○ | ○ | ○ | ○ |
WebRTC ICE signed + anti-replay ed25519 · 30 s window | ● | ◐ | ○ | ◐ | ○ |
Double Ratchet — full Signal 3-step dh + chain + mk | ● | ● | ● | ● | ○ |
Independent external audit third-party review | pending | ● | partial | ● ISO | partial |
Launch happens once.Be there.
We'll only email you about the public release and the external audit results. No marketing. Unsubscribe is a single click.