Security
Everything here is built in and automatic: there’s nothing to set up, and no key or setting you could weaken by mistake.
Calls are encrypted end to end between your Tahaa and your phone. A new key is made for every call, and only your box and your phones hold it: not even the Tahaa service can listen. Digits you type during a call (codes, PINs) are encrypted the same way.
How: the call’s 256-bit key is drawn at random by your box (incoming call) or your phone (outgoing call), then sealed for the other side with HPKE (X25519, HKDF-SHA-256, ChaCha20-Poly1305). The Tahaa service and the media relay only ever carry the sealed key. Each audio frame is encrypted with AES-128-GCM, and the digits with AES-256-GCM. Your box refuses a call that comes without its key.
Messages
Section titled “Messages”Texts and pictures (SMS and MMS) are encrypted end to end between your Tahaa and your phones. The Tahaa service, hosted in Paris (France), only keeps messages it can’t read, for 30 days, long enough for all your phones to get them; each phone then keeps its own copy. They’re never sold or analysed. Between your box and the person you’re writing with, they travel over the mobile network as SMS and MMS, as on any phone.
How: every message gets its own random 256-bit key. Its content is encrypted with ChaCha20-Poly1305, and locked to that message, its direction and the person you’re writing with, so it can’t be passed off as another one. The key is sealed with HPKE for each of your phones and browsers (up to 10), and for your box when you send. Your box encrypts what it receives and decrypts what you send by itself. On your phone, the messages are kept in the app’s private storage, under your phone’s own encryption.
Notifications
Section titled “Notifications”Notifications are encrypted for your phone alone and signed by the Tahaa service: Apple and Google carry them without being able to read them, and your phone ignores any it didn’t receive from us.
How: each notification is sealed with HPKE for that phone’s key, which it renews every 30 days, and signed with Ed25519. Your phone checks the signature, and refuses one that’s older than 10 minutes or that it has seen before.
Your contacts
Section titled “Your contacts”Your phone’s contacts are read on your phone only, to show names: they’re never sent to the Tahaa service.
The box
Section titled “The box”Each Tahaa makes its own identity key the first time it starts; it never leaves the box. It only starts, and only installs, software signed by us; its memory is encrypted, and every connection it makes is encrypted.
How: the identity key is an Ed25519 key made from the chip’s hardware random generator; your box proves who it is by signing with it. Its software carries an RSA-3072 signature, checked at every start (secure boot) and before an update is installed. Its flash memory, including the identity key and its settings, is encrypted with AES-XTS-256, with a key made by the chip itself that never leaves it. Every connection uses TLS. Setting up the box’s Wi-Fi over Bluetooth goes through an encrypted session between your box and the Tahaa service: your phone only passes along data it can’t read. A SIM PIN you type in the app is sealed for your box alone.
On your phone
Section titled “On your phone”The app’s keys stay in your phone’s secure storage: the Keychain on iPhone, the Keystore on Android; in a browser, keys that can’t be exported. They’re made and renewed automatically.
Your account
Section titled “Your account”You sign in with a code sent to your email: there’s no password to steal. Deleting your account deletes everything: see Your account. More in the privacy policy.
In short
Section titled “In short”| What | How |
|---|---|
| Call and message keys | 256 bits, random, one per call or message; sealed with HPKE (X25519, HKDF-SHA-256, ChaCha20-Poly1305) |
| Call audio | AES-128-GCM, end to end |
| Digits during a call | AES-256-GCM, end to end |
| Texts and pictures | ChaCha20-Poly1305, end to end, one key per message |
| Notifications | Sealed for your phone (HPKE), signed by the service (Ed25519) |
| Box identity | Ed25519, made by the box, never leaves it |
| Software | Signed by us (RSA-3072), checked at every start and before every update |
| Box memory | AES-XTS-256, with a key made by the chip |
| Connections | TLS; call media in DTLS-SRTP |