Security: E2E Encryption Layer for Trusted Devices

[sanchxt]

Description

Additional end-to-end encryption layer beyond TLS for trusted device connections.

Requirements

• Optional E2E encryption (opt-in per transfer or device)
• Device keypairs: Ed25519 key exchange, ChaCha20-Poly1305 data encryption
• Perfect forward secrecy with ephemeral session keys
• CLI: yoop send Device "file.txt" --e2e
• Config: Trust level "e2e_required" enforces encryption
• Visual indicator in TUI/Web when E2E active

Technical Details

• Diffie-Hellman key exchange with device Ed25519 keys
• Session key derivation: HKDF-SHA256
• Data encryption: ChaCha20-Poly1305 AEAD
• Protocol: E2E layer inside TLS tunnel (defense in depth)

Security Model

• TLS: Transport protection (MITM)
• E2E: Data protection (compromised server)
• Both layers required for "e2e_required" trust level