A Revolutionary Approach to Secure Communications

True End-to-End Encryption Without Intermediaries

• Elimination of Third Parties: Bitfi establishes an encrypted handshake directly between two devices, removing the need for servers or centralized key management systems that could be potential points of compromise.
• Blockchain-Verified Public Keys: Public keys are retrieved from a decentralized blockchain smart contract, ensuring authenticity and preventing man-in-the-middle attacks.
• Zero Trust Architecture: By not relying on any external entities, Bitfi embodies a zero-trust model, eliminating vulnerabilities associated with trusting third parties.

Technical Insight:

• Blockchain Integration: Utilizes the XDC blockchain (or any smart contract-enabled blockchain) for registering and retrieving aliases and public keys.
• Smart Contracts: Implements custom RPC methods for alias registration and key retrieval, ensuring decentralized and tamper-proof identity management.

Advanced Cryptography That Defies Compromise

• Elliptic Curve Cryptography (ECC): Employs ECC for key generation and encryption processes, offering robust security with smaller key sizes compared to traditional RSA encryption.
• Diceware Method for Passphrase Generation: Encourages users to create passphrases using the diceware method, resulting in high-entropy secrets that are virtually impossible to brute-force.
• Mathematical Fortification: Current models suggest it would take the most powerful computers over 30 million years to crack the encryption used by Bitfi.

Technical Insight:

Key Derivation Functions:

• KDF-1: Combines scrypt (RFC 7914) with BIP 32 to derive hierarchical deterministic (HD) keys from user-supplied salt and passphrase, adding computational cost for enhanced security.
• KDF-2: Uses Elliptic-Curve Diffie-Hellman (ECDH) to derive shared secrets for secure key exchange between users.
• KDF-3: Generates random scalars during call acceptance to ensure unique and secure encryption keys for each session.

Stateless Devices for Absolute Security

• Ephemeral Sessions: All data, including call history and messages, exists only during an active session. Once the session ends, the data is wiped clean with no residual traces left on the device.
• On-the-Fly Reconstruction: When a user initiates a new session with their Salt & Phrase, the device securely reconstructs the necessary data from the blockchain, ensuring seamless continuity without local storage.

Technical Insight:

• Memory Management: Implements exhaustive security measures to prevent data persistence in memory, overcoming challenges posed by garbage collection and immutable string types in the Android Runtime (ART).
• Protected User Space: Sensitive data is handled within a secure environment to prevent exposure or leakage, even under advanced forensic analysis.

Eliminating Traditional Password Vulnerabilities

• Unique Salt & Phrase Combination: Users authenticate by entering a unique Salt & Phrase, which is used to derive private keys without storing any credentials on the device.
• Resistance to Physical Compromise: Since no data is stored on the device, losing it poses no security risk. Unauthorized parties cannot retrieve any usable information.

Technical Insight:

• Key Derivation Process:
  • Utilizes scrypt to add computational cost and resist brute-force attacks.
  • BIP 32 ensures a consistent derivation path for secure communication.

Your Phone is in Your Mind

• Hardware-Agnostic Access: Users can access their communication environment from any Bitfi device by simply entering their Salt & Phrase.
• Unlimited Phones from a Single Device: Multiple users can share the same device without accessing each other’s data, and a single user can maintain multiple independent communication profiles.

Technical Insight:

• Stateless Operation: Devices function without retaining user-specific data, relying on real-time key derivation and blockchain interactions to recreate the user environment.

Invisible Communication Channels

• Proprietary UDP Packet Handling: Uses unique handling of UDP headers to prevent the exposure of IP addresses, locations, or timestamps.
• No Cellular or Bluetooth Connectivity: Devices connect only via Wi-Fi, eliminating other wireless interfaces that could be exploited.

Technical Insight:

• UDP Connection Mechanics:
  • MEDIA.async360: Establishes UDP connections for media streaming using TURN-like server implementations to traverse NATs without revealing endpoint details.
  • PRESENTATION TIME Header: Uses system uptime in nanoseconds for packet timing without exposing real-world time or location.

Enhanced Operational Security

• Blockchain-Based Aliases: Users communicate using aliases registered on a decentralized smart contract, decoupling communication identities from personal information.
• Dynamic Persona Management: Users can change aliases or maintain multiple ones, preventing adversaries from tracking communication patterns.

Technical Insight:

• Alias Registration and Retrieval:
  • RPC-METHOD.1: Register alias and public key on the blockchain.
  • RPC-METHOD.2: Retrieve alias associated with a public key.
  • RPC-METHOD.3: Retrieve public key associated with an alias.
• Immutable Records: The blockchain ensures that alias-public key pairs are tamper-proof and globally verifiable.

Defeating Voice Impersonation and Spoofing

• Salt & Phrase Verification: Only users possessing the correct Salt & Phrase can initiate calls from a specific alias, ensuring authenticity.
• Immutable Device Hash: Devices display a hash after entering the first three characters of the Salt & Phrase, allowing users to verify device integrity and prevent cloned device attacks.

Technical Insight:

• Three-Key Device Hash Feature: Provides a method for users to confirm they’re entering their credentials on a legitimate device before completing authentication.
• AI Voice Simulation Defense: Since authentication is based on cryptographic keys rather than voice recognition, voice impersonation attacks are ineffective.

Security Without Assumptions

• No Trust Required in Bitfi: The system is designed so that even Bitfi cannot access user communications or keys, eliminating risks associated with insider threats.
• Fixed Firmware: Devices have immutable firmware, preventing updates that could introduce vulnerabilities or backdoors.

Technical Insight:

• End-to-End Encryption: All encryption and key exchanges happen directly between devices, with no intermediary steps that could be exploited.
• Open Architecture: While the system is proprietary, the reliance on established cryptographic standards and blockchain technology allows for transparency and auditability.