# Glossary

Alphabetical glossary of terms used throughout the quicprochat documentation.
Each entry includes a brief definition and, where applicable, a reference to the
relevant specification or documentation page.

---

**AEAD** -- Authenticated Encryption with Associated Data. A symmetric encryption
scheme that provides both confidentiality and integrity. quicprochat uses
AES-128-GCM (in the MLS ciphersuite). See [Cryptography Overview](../cryptography/overview.md).

**ALPN** -- Application-Layer Protocol Negotiation. A TLS extension that allows
the client and server to agree on an application protocol during the TLS
handshake. quicprochat v2 uses the ALPN token `"qpc"` (replacing the legacy
`"capnp"` token used in v1). See [Wire Format Overview](../wire-format/overview.md).

**Argon2id** -- A memory-hard password hashing and key derivation function
(winner of the Password Hashing Competition, 2015). quicprochat uses Argon2id
to derive the SQLCipher encryption key from the server's passphrase, and
optionally for client-side key derivation. See [Storage Backend](../internals/storage-backend.md).

**AS** -- Authentication Service. The server component that handles OPAQUE
registration and login, stores single-use MLS KeyPackages, and manages hybrid
post-quantum public keys. See [Authentication Service Internals](../internals/authentication-service.md).

**Cap'n Proto** -- A zero-copy serialisation format with a built-in RPC system.
Used in quicprochat v1 for all wire messages and service RPCs. Schemas lived in
`schemas/*.capnp`. In v2, Cap'n Proto is replaced by Protobuf (prost) for RPC
messages, though the legacy Cap'n Proto types remain in `quicprochat-proto` for
backward compatibility. See the v1 archive in `crates/quicprochat-proto/`.

**Commit** -- An MLS message type that advances the group to a new epoch. When a
member sends a Commit (e.g., after adding or removing a member), all group
participants update their key schedule. Commits are the mechanism for both
forward secrecy and post-compromise security.
See [MLS (RFC 9420)](../protocol-layers/mls.md).

**Credential** -- An MLS identity binding that associates a member's signing key
with their identity. quicprochat uses `BasicCredential`, which contains the
raw Ed25519 public key bytes. See
[Ed25519 Identity Keys](../cryptography/identity-keys.md).

**DER** -- Distinguished Encoding Rules. A binary encoding format for ASN.1
structures, used for X.509 certificates and TLS certificate chains. The
self-signed TLS certificate generated by quicprochat is DER-encoded.

**DS** -- Delivery Service. The server component that provides store-and-forward
relay for opaque MLS payloads. The DS never inspects ciphertext -- it routes
solely by recipient public key, channel ID, and device ID.
See [Architecture Overview](../architecture/overview.md).

**Ed25519** -- Edwards-curve Digital Signature Algorithm on Curve25519. Used for
MLS identity credentials and signing (KeyPackages, Commits, group operations).
quicprochat uses the `ed25519-dalek` crate.
See [Ed25519 Identity Keys](../cryptography/identity-keys.md).

**Epoch** -- The version number of an MLS group's key state. Each Commit
advances the epoch by one. Messages encrypted under epoch *n* cannot be
decrypted by members who have advanced to epoch *n+1*, providing forward secrecy.
See [Forward Secrecy](../cryptography/forward-secrecy.md).

**Forward Secrecy (FS)** -- The property that past sessions remain secure even
if long-term keys are later compromised. In MLS, forward secrecy is achieved by
the epoch ratchet: key material from earlier epochs is deleted when the epoch
advances. See [Forward Secrecy](../cryptography/forward-secrecy.md).

**HKDF** -- HMAC-based Key Derivation Function. Used in MLS to derive symmetric
keys from shared secrets. quicprochat uses HKDF-SHA256.

**HPKE** -- Hybrid Public Key Encryption. The public-key encryption scheme used
in MLS for key exchange (encrypting to a KeyPackage's init key). Defined in
RFC 9180. In quicprochat, HPKE uses DHKEM(X25519, HKDF-SHA256).
See [Hybrid KEM](../protocol-layers/hybrid-kem.md).

**KEM** -- Key Encapsulation Mechanism. A cryptographic primitive that generates
a shared secret and an encapsulated (encrypted) version of that secret. Used in
HPKE and in the hybrid post-quantum construction (X25519 + ML-KEM-768).

**KeyPackage** -- An MLS structure containing a member's public key material
(HPKE init key, signing key, credential) that peers use to add the member to a
group. KeyPackages are single-use per the MLS specification (RFC 9420) -- each
is consumed on fetch. See
[ADR-005: Single-Use KeyPackages](../design-rationale/adr-005-single-use-keypackages.md).

**ML-KEM-768** -- Module-Lattice-based Key Encapsulation Mechanism, security
level 3 (NIST FIPS 203). A post-quantum KEM based on the hardness of the
module learning-with-errors (MLWE) problem. quicprochat uses ML-KEM-768 in a
hybrid construction with X25519 for post-quantum sealed envelope encryption.
See [Post-Quantum Readiness](../cryptography/post-quantum-readiness.md).

**MLS** -- Messaging Layer Security. A protocol for group key agreement defined
in RFC 9420. MLS provides forward secrecy and post-compromise security for
groups of any size through an efficient tree-based key schedule.
See [MLS (RFC 9420)](../protocol-layers/mls.md).

**OPAQUE** -- Asymmetric Password-Authenticated Key Exchange (RFC 9497). A
password authentication protocol in which the server never learns the user's
password, not even during registration. The server stores an OPAQUE registration
record derived from the password. quicprochat uses OPAQUE for all user
authentication (replacing static token auth in v1).
See [Authentication Service Internals](../internals/authentication-service.md).

**PCS** -- Post-Compromise Security. The property that a protocol recovers
security after a member's state is compromised. In MLS, once a compromised
member sends an Update or Commit, subsequent epochs are secure again (assuming
the attacker does not maintain persistent access).
See [Post-Compromise Security](../cryptography/post-compromise-security.md).

**PIR** -- Private Information Retrieval. A cryptographic technique that allows
a client to fetch a record from a database without the server learning which
record was requested. Explored as a future enhancement for metadata-hiding
KeyPackage and message fetch.
See [Future Research](../roadmap/future-research.md).

**prost** -- A Rust Protobuf code generation and runtime library. Used in
quicprochat v2 to generate Rust types from `proto/qpc/v1/*.proto` files at
build time. The generated types live in `crates/quicprochat-proto/`.
See [Rust Crate Documentation](references.md).

**Protobuf** -- Protocol Buffers. A language-neutral, binary serialisation format
from Google. quicprochat v2 uses Protobuf for all RPC message payloads, encoded
using the `prost` crate. Proto definitions live in `proto/qpc/v1/`.
See [Wire Format Overview](../wire-format/overview.md).

**QUIC** -- A UDP-based, multiplexed, encrypted transport protocol defined in
RFC 9000. QUIC integrates TLS 1.3 for authentication and confidentiality and
provides 0-RTT connection establishment, stream multiplexing, and built-in
congestion control. quicprochat uses the `quinn` crate.
See [QUIC + TLS 1.3](../protocol-layers/quic-tls.md).

**Ratchet Tree** -- The binary tree data structure used in MLS for efficient
group key derivation. Each leaf corresponds to a group member; internal nodes
hold derived key material. Updates propagate along the path from a leaf to the
root, giving O(log N) cost for key updates in a group of N members.

**SQLCipher** -- An open-source extension to SQLite that provides transparent,
page-level AES-256 encryption of the database file. quicprochat uses SQLCipher
as the primary server-side storage backend via the `rusqlite` crate with the
`sqlcipher` feature. The encryption key is derived from a server passphrase
using Argon2id. See [Storage Backend](../internals/storage-backend.md).

**TLS 1.3** -- Transport Layer Security version 1.3, defined in RFC 8446. The
standard for authenticated, encrypted transport. quicprochat uses TLS 1.3
exclusively (via `rustls` with `TLS13` cipher suites only) as part of the QUIC
transport. See [QUIC + TLS 1.3](../protocol-layers/quic-tls.md).

**Welcome** -- An MLS message sent to new members when they are added to a
group. The Welcome contains the group state (ratchet tree, group context,
epoch secrets) encrypted under the new member's HPKE init key from their
KeyPackage. See [MLS (RFC 9420)](../protocol-layers/mls.md).

**X25519** -- Elliptic curve Diffie-Hellman key exchange on Curve25519 (using
the Montgomery form). Used as the classical component of DHKEM in MLS HPKE
and in the hybrid KEM (X25519 + ML-KEM-768).
quicprochat uses the `x25519-dalek` crate.
See [Cryptography Overview](../cryptography/overview.md).

**Zeroize** -- The practice of securely clearing sensitive data (private keys,
shared secrets) from memory when it is no longer needed. quicprochat uses the
`zeroize` crate with the `ZeroizeOnDrop` derive macro to ensure that key material
is overwritten on drop.
See [Key Lifecycle and Zeroization](../cryptography/key-lifecycle.md).
