{"architecture":{"cryptographic_domains":["messages","voice","media","rtc","identity"],"domain_count":5,"domain_separation":true,"kem_algorithm":"ML-KEM-1024","overlap_seconds":3600,"rotation_policy":"daily-with-bounded-overlap"},"attestation_type":"automated-self-verification","generated_at":"2026-08-29T03:15:37Z","implementation":{"verification_binary_sha256":"88B805E34122F91F98F89D30B01BA560C0A0148133753257011900F4CE7D35CA"},"independent_audit":false,"limitations":["This is a signed self-attestation and not an independent certification.","The suite uses ephemeral keys and deliberately excludes production secrets and user data."],"overall_result":"PASS","product":"Majax Messenger","schema":"https://majax.app/security/schemas/attestation-v2.json","schema_version":2,"scope":{"description":"Ephemeral public verification with no production keys or user data","persistent_test_keys":false,"production_secrets_accessed":false,"production_user_data_accessed":false},"tests":{"domains":[{"algorithm":"ML-KEM-1024","checks":{"algorithm_identifier":true,"encapsulation_decapsulation_match":true,"ephemeral_key_uniqueness":true,"mlkem_1024_object_dimensions":{"ciphertext":true,"private_key":true,"public_key":true,"shared_secret":true}},"domain":"messages","result":"PASS","timings_ms":{"decapsulation":1.485,"encapsulation":1.673,"key_generation":4.928}},{"algorithm":"ML-KEM-1024","checks":{"algorithm_identifier":true,"encapsulation_decapsulation_match":true,"ephemeral_key_uniqueness":true,"mlkem_1024_object_dimensions":{"ciphertext":true,"private_key":true,"public_key":true,"shared_secret":true}},"domain":"voice","result":"PASS","timings_ms":{"decapsulation":1.185,"encapsulation":1.504,"key_generation":1.149}},{"algorithm":"ML-KEM-1024","checks":{"algorithm_identifier":true,"encapsulation_decapsulation_match":true,"ephemeral_key_uniqueness":true,"mlkem_1024_object_dimensions":{"ciphertext":true,"private_key":true,"public_key":true,"shared_secret":true}},"domain":"media","result":"PASS","timings_ms":{"decapsulation":1.254,"encapsulation":1.078,"key_generation":1.176}},{"algorithm":"ML-KEM-1024","checks":{"algorithm_identifier":true,"encapsulation_decapsulation_match":true,"ephemeral_key_uniqueness":true,"mlkem_1024_object_dimensions":{"ciphertext":true,"private_key":true,"public_key":true,"shared_secret":true}},"domain":"rtc","result":"PASS","timings_ms":{"decapsulation":1.141,"encapsulation":1.212,"key_generation":1.143}},{"algorithm":"ML-KEM-1024","checks":{"algorithm_identifier":true,"encapsulation_decapsulation_match":true,"ephemeral_key_uniqueness":true,"mlkem_1024_object_dimensions":{"ciphertext":true,"private_key":true,"public_key":true,"shared_secret":true}},"domain":"identity","result":"PASS","timings_ms":{"decapsulation":1.293,"encapsulation":1.549,"key_generation":1.021}}],"maurice_hmac_v2":{"canonical_form":"METHOD|PATH|TS|NONCE|DEVICE_ID|SHA256(BODY)","checks":{"body_mutation_rejected":true,"exact_replay_rejected":true,"fresh_nonces_are_distinct":true,"path_mutation_rejected":true,"production_source_invariants":{"canonical_form_present":true,"replay_cache_check_present":true,"replay_rejection_present":true,"strict_hmac_v2_present":true,"timing_safe_comparison_present":true},"valid_canonical_request_accepted":true},"evidence_mode":"independent-reference-model-plus-production-source-binding","production_middleware_sha256":"AC5DC96E21230A84E91BE616848EAF92905D388D046EB5886D465C7C373C697E","protocol":"Maurice-HMAC-v2","result":"PASS"},"negative":{"cross_domain_private_key_implicit_rejection":{"domain_pairs":[{"ciphertext_domain":"messages","decapsulation_ms":1.264,"private_key_domain":"voice","result":"PASS"},{"ciphertext_domain":"voice","decapsulation_ms":1.248,"private_key_domain":"media","result":"PASS"},{"ciphertext_domain":"media","decapsulation_ms":1.17,"private_key_domain":"rtc","result":"PASS"},{"ciphertext_domain":"rtc","decapsulation_ms":1.432,"private_key_domain":"identity","result":"PASS"},{"ciphertext_domain":"identity","decapsulation_ms":1.438,"private_key_domain":"messages","result":"PASS"}],"result":"PASS","semantics":"a private key from another domain cannot recover the original secret"},"tampered_ciphertext_implicit_rejection":{"domains":[{"decapsulation_ms":1.345,"domain":"messages","result":"PASS"},{"decapsulation_ms":1.304,"domain":"voice","result":"PASS"},{"decapsulation_ms":1.338,"domain":"media","result":"PASS"},{"decapsulation_ms":1.275,"domain":"rtc","result":"PASS"},{"decapsulation_ms":1.188,"domain":"identity","result":"PASS"}],"result":"PASS","semantics":"decapsulation returns a divergent pseudorandom secret"}},"not_evaluated":{"application_nonce_management":{"reason":"Maurice request nonces are tested here; media, RTC and Android storage nonces require separate application harnesses.","result":"NOT_EVALUATED"},"signal_forward_secrecy":{"reason":"Requires a stateful two-party Signal ratchet harness using the production Android stores.","result":"NOT_EVALUATED"},"signal_mlkem_composition":{"reason":"Production composes a KEM envelope inside Signal; the public suite does not execute the Android Signal engine.","result":"NOT_EVALUATED"},"signal_post_compromise_recovery":{"reason":"Requires compromise-and-recovery tests across successive production-compatible Signal ratchets.","result":"NOT_EVALUATED"}}}}