Skip to content

PITCH.md

Latest commit

 

History

History
64 lines (42 loc) · 3.88 KB

PITCH.md

File metadata and controls

64 lines (42 loc) · 3.88 KB
Raw

🛡️ Project VBSC: Trust Nothing. Verify Everything.

Welcome to Project VBSC (Vault-Based Secure Communication).

Traditional secure messaging applications suffer from a fatal flaw: Passive Centralized Trust. If a Certificate Authority (CA) is compromised, or a central server is breached, user identities can be spoofed and metadata can be harvested.

VBSC is our solution to this problem. We designed a Zero-Trust, Zero-Knowledge communication protocol that shifts the "Root of Trust" from passive certificates to an active, immutable Vault Authority.

🚀 The Core Innovation

At its heart, VBSC is an End-to-End Encrypted (E2EE) chat and signaling system that assumes the network and the relay servers are completely hostile.

1. The Vault Authority (The "Digital Notary")

Instead of just handing out certificates, our Vault acts as a central source of truth. Before a client can connect to the relay server, they must mathematically prove their identity to the Vault.

  • Sign-then-Encrypt Attestation: Clients sign a request using Ed25519 and the Vault responds with an encrypted "Statement of Trust" using X25519 (ECDH) + HKDF-SHA256 + AES-GCM.
  • Transparency Logging: Every attestation is logged into a Merkle Tree. This guarantees that if the Vault is ever compromised or forced to issue a fake identity, there will be cryptographic proof of the discrepancy.

2. Zero-Knowledge Relay Servers

Our servers are just dumb pipes. They do not know who is talking to who, and they cannot read the messages.

  • Identity-Bound Rate Limiting: If a user spams the network, the server drops their connection based on their Vault ID, all without ever needing to decrypt their traffic.

3. Dual-Port TLS Strategy

Hardware matters. VBSC implements a unique dual-port TLS architecture:

  • Port 8443 (TLS 1.2): For legacy compatibility.
  • Port 9443 (TLS 1.3 Only): Hardened endpoint that restricts communication to the most secure cryptographic primitives (TLS_AES_128_GCM_SHA256) and removes legacy handshakes.

💼 Real-World Impact & Business Value

Why does this matter? VBSC isn't just a toy protocol; it solves massive enterprise problems:

  1. Healthcare & Finance (Compliance): By utilizing E2EE with an immutable Merkle Tree audit log, VBSC provides instantaneous pathways to strict HIPAA, GDPR, and SOX compliance.
  2. Defense against Insider Threats: Because the relay server cannot decrypt traffic or forge identities, a rogue system administrator or a breached server yields zero actionable data to an attacker.
  3. Enterprise Whitelabeling: Organizations can run their own "Vault," completely segregating their communications from public infrastructure while maintaining military-grade security.

🏗️ Architecture at a Glance

graph TD
    ClientA[👤 Client A<br>Ed25519 Identity] -->|1. Request Identity Proof| Vault((🛡️ Vault Authority<br>Root of Trust))
    Vault -->|2. Encrypted Attestation| ClientA
    
    ClientA -->|3. Connect with Proof| Relay[🌐 Relay Server<br>Zero-Knowledge]
    Relay -->|4. Forward Signal| ClientB[👤 Client B<br>Ed25519 Identity]
    
    ClientA -.->|5. E2E Encrypted Chat<br>AES-256-GCM| ClientB
    
    style Vault fill:#f9f,stroke:#333,stroke-width:2px
    style Relay fill:#bbf,stroke:#333,stroke-width:2px
Loading

🎯 Hackathon Highlights

  • Cryptographic Independence: Built using raw Ed25519/X25519 primitives without relying on heavy third-party identity providers (No Auth0, No Firebase Auth).
  • Glassmorphism UI: A stunning, modern React frontend that makes "cybersecurity" feel sleek and premium.
  • Resilient Polling & Sockets: Smart fallbacks for STOMP/WebSockets.

We invite you to dive into the codebase. Check out vault-authority-service to see the Merkle Tree in action, or spin up the new-client-side to experience the seamless E2EE handshake yourself!