@biocrypt/kyber-chat

Self-hostable WebSocket relay + browser UI for small private chats, with post-quantum wire crypto: ML-KEM-768 (Kyber) for key encapsulation, ML-DSA-65 for signatures, AES-256-GCM for message confidentiality. Public keys and ciphertexts use TACG-2bit-v1 DNA encoding (00→T, 01→A, 10→C, 11→G; four letters per byte).

Hosted demo: kyber.biocrypt.net

This package is not interoperable with legacy RSA-DNA @biocrypt/private-chat or with builds that used the older ACGT bit ordering.

Run it

npx @biocrypt/kyber-chat

Defaults: port 8787, 0.0.0.0. Then open the printed URL in a browser.

npx @biocrypt/kyber-chat --port 9000
npx @biocrypt/kyber-chat --host 127.0.0.1 --port 8787
PORT=9000 HOST=127.0.0.1 npx @biocrypt/kyber-chat

Custom UI tree (must include index.html and assets):

npx @biocrypt/kyber-chat --static ./path/to/static

GET /healthz returns JSON { ok, clients } for probes.

Deploy (BioCrypt lab)

From this repository:

npm run build
./deploy/sync-biocrypt-prod.sh

See deploy/README.md for Apache, pm2, and paths on devpipika (/home/dev/kyber). The layout mirrors p2p-chat (p2p.biocrypt.net).

Using the app

1. Create link — Create a room; share the invite URL (fragment carries room + host public DNA; not sent in Referer).
2. Link creator — Approve or decline join requests.
3. Join — Open the invite, enter a name, join; retries apply while waiting for admission.
4. Chat — Select recipients, send; each copy is encrypted to that peer’s Kyber public key.

Host keys: link creator secrets live in memory and sessionStorage for same-tab recovery; page unload clears persisted host material (see behaviour notes in private-chat README).

Invite link format

https://<page>/#c=<base64url(JSON)>

| Field | Meaning | | --- | --- | | v | Bundle version (1) | | r | Room id (16 random bytes as TACG DNA, 64 letters) | | h | Host public key DNA (GTACTTTT… prefix for PQ v1) | | w | (optional) WebSocket URL |

Library API

import { createServer, createRelay, buildLink, parseLink } from "@biocrypt/kyber-chat";

const { server, relay, staticDir } = createServer();
server.listen(8787);

const link = buildLink({
  baseUrl: "https://example.com/app/",
  room: "…",           // DNA room id from randomRoomId() or equivalent
  hostPubDna: "GTACTTTT…",
});
const { v, room, hostPubDna, wsUrl } = parseLink(link);

Wire protocol

Frames use meta.proto === "gemix-private" with PQ ciphertexts (see static/lib/gemix-protocol.mjs). Routing hashes are SHA-256(pub DNA) encoded as TACG DNA (128 letters), not hex.

License

MIT