Learn about Private Chat's new ECDH P-256 key exchange system with AES-256-GCM encryption and automatic Dual AES switching, all protected by KeyFortress™.
## Private Chat Encryption - January 2026 Update We've completely redesigned Private Chat encryption to provide true end-to-end security using ECDH (Elliptic Curve Diffie-Hellman) key exchange. ### The Problem We Solved Previously, each device generated unique local AES keys, which meant messages encrypted on one device couldn't be decrypted on another. This critical bug has been fixed with proper cryptographic key exchange. ### How ECDH Key Exchange Works #### 1. Key Generation When you start a conversation, your device generates: - A private key (never leaves your device) - A public key (shared with your chat partner) #### 2. Secure Key Exchange - Both users exchange public keys via our secure server - Private keys are stored as NON-EXTRACTABLE CryptoKeys in IndexedDB - Even XSS attacks cannot steal your private keys #### 3. Shared Secret Derivation Using ECDH P-256 curve with HKDF: - Both devices derive the same shared secret - This secret is used for AES-256-GCM encryption - The shared secret is NEVER transmitted or stored ### Dual AES Enhancement When you set a secret key in chat settings: - System automatically switches to Dual AES - Double encryption layer for extra security - Visual badge shows "Dual AES" active ### KeyFortress™ Protection All encryption keys are protected by KeyFortress™: - Shamir's Secret Sharing splits keys into 5 parts - Only 3 parts needed to reconstruct - 100 decoy keys confuse attackers - Anti-debugging detection active ### Technical Specifications - **Curve**: P-256 (NIST approved) - **Key Derivation**: HKDF with SHA-256 - **Encryption**: AES-256-GCM - **Key Storage**: IndexedDB (non-extractable) - **Database**: private_chat_keys table