Security Level
How hard it is to break
Panthera composes only vetted, standard primitives — no hand-rolled crypto. Every primitive comes from libsodium (sumo build). Attack surface is minimised to the smallest possible trusted computing base.
Signal-class · 256-bit · Forward & post-compromise secrecy
Confidentiality
XChaCha20-Poly1305 AEAD
256-bit key · 192-bit nonce
Forward secrecy
Symmetric chain ratchet
Each message a fresh key
Post-compromise
DH ratchet on flip
Recovery from key leak
Authenticity
Poly1305 MAC + Ed25519
Sender bound by RLS
Handshake
X3DH (3 or 4 DH)
Ed25519 → X25519 conversion
Key storage
Sealed IndexedDB
In-memory KEK only