Security — OneEur

Cryptography

Well-known standards, no custom crypto.

Your key is made on your phone

The app creates a random 32-byte Ed25519 secret on your phone. It is encrypted with a key derived from your 6-digit PIN (scrypt, then XChaCha20-Poly1305) and stored in the phone’s Keychain or Keystore. It is never sent anywhere.

Your address catches typos

Your address is your public key plus a 4-byte SHA-256 checksum, written in base32 after oe_ed25519_. If a single character is wrong, the checksum fails and the payment is stopped before any money moves.

Every block is hashed and signed

To pay, the app writes the block’s fields in one fixed byte layout and hashes them with SHA-256. That hash is the block’s ID. Your phone then signs the hash with your Ed25519 key.

Holders check everything

Each chain holder rebuilds the bytes, hashes them again and checks the signature against the wallet’s public key. If any field was changed (amount, receiver, memo), the block is rejected. Holders run these checks again every time they restart.

Hashes link the chains

Each block holds the hash of the block before it, so past blocks can’t be changed without breaking every block after them. A receive holds the hash of the send it collects, which links the two chains together.

Not tied to one key type

Every key in a block starts with an algorithm number and its length, and every address names its algorithm (oe_ed25519_ today, for example oe_p256_ later). The sender and receiver each carry their own algorithm, so wallets with different key types can pay each other.

Post-quantum ready

Built to switch signatures without starting over

Ed25519 is the only algorithm switched on today. The block format and network were designed so that post-quantum signatures can be added later without a new chain.

Room for big keys. Key lengths are stored in 2 bytes, so keys up to 65,535 bytes fit. Post-quantum public keys are often over a thousand bytes.
Same block format. A new algorithm only needs a new ID and its key and signature sizes. ONEEUR-BLOCK-V1 stays the same, and so do existing chains.
No mix-ups. A wallet is identified by its algorithm and public key together, so the same key bytes under two algorithms always count as two different wallets.
Storage is ready. Holders already name wallet files safely when a post-quantum address is too long for a file name.
Safe until switched on. Holders reject blocks with an algorithm they don’t support (unsupported_algorithm), so nothing is accepted before it is ready.
Easy to move. Payments between key types already work, so moving your coins to a post-quantum wallet would be an ordinary payment.

The exact bytes that are hashed and signed are on How it works.

On your phone

Your key is locked with your PIN.

Encrypted, then stored in secure storage

The wallet’s secret is encrypted with a key derived from your 6-digit PIN (scrypt, then XChaCha20-Poly1305). Only the encrypted box is stored, in the iOS Keychain or Android Keystore. Neither the secret nor the PIN is ever sent anywhere.

The PIN is asked when it matters

You enter your PIN to open the app, after it has been in the background for a minute, and before copying your recovery key, changing the PIN or removing the wallet. After 5 wrong PINs the app makes you wait: 30 seconds, doubling each time, up to an hour.

Back up your recovery key

Your recovery key is the only way to get your wallet back on a new phone. Copy it from Settings and keep it somewhere safe and offline. Anyone who has it can spend your coins, and nobody, including OneEur, can recover it for you.

Names stay on your phone

Names you give to addresses (“Mom”, “Coffee shop”) are kept only on your phone. Chains hold addresses, never names.

Choose a PIN screen: six digits that open the wallet and encrypt the secret key on the phone — Your PIN also encrypts your key

The network

How chain holders are protected.

Holders only connect out

A chain holder opens an encrypted WebSocket (wss://) to the network. It needs no open ports, so it can run safely behind a home router.

Every holder proves who it is

Each holder has its own Ed25519 key. When it connects, it must sign a random challenge, and only holders whose public keys the network operator has added are let in.

A small, fixed set of requests

A holder only answers a fixed list of requests: take copies of confirmed blocks, report its status, and hand out blocks for syncing. The two sides never run each other’s code.

Holders check everything themselves

Every holder checks each block’s signature and the ledger rules on its own, and refuses anything that does not fit, even if it comes from the network.

Be aware

What is not done yet.

Early network

OneEur is still a young network

We would rather you know the limits than find them. These are the main ones today.

One primary confirms. The primary decides which of two conflicting blocks wins. It is trusted, and while it is down no new payments can be confirmed. There is no automatic failover yet.
No rate limits yet. There is no spam protection on submitting valid blocks.
A PIN is short. A 6-digit PIN cannot resist offline guessing on its own. The real protection is that the encrypted key never leaves the phone’s secure storage. Biometric unlock and a stronger native key derivation are still to come.
Memos are public. A memo is signed and kept forever on both chains and every holder, and anyone can see it in the explorer. Never put private information in it.

Keep reading

Your key never leaves your phone.