A Glossia deployment has five kinds of component. Only clients ever hold the keys that decrypt messages.
- Client
- An app on a phone or computer. Clients hold all keys, encrypt and decrypt all messages and choose the route each message takes.
- Entry relay
- The relay a client connects to. It knows the client’s network address, but not who the client is talking to.
- Transit relay
- A relay in the middle of a route. It knows only the relay before it and the relay after it.
- Mailbox relay
- A relay that holds messages until their recipient collects them. It knows a mailbox address, which changes every day, but not who owns it or who sent the message.
- Bridge
- An entry relay that is not listed in the public directory, for people whose networks block listed relays.
- Directory
- The signed list of every relay, published hourly. See The relay directory.
- Key transparency log
- A public, append-only record of which identity key belongs to which username. See Key transparency.
How a message travels
- The sender’s client encrypts the message end to end for each of the recipient’s devices, pads it to a fixed size and wraps it in three layers of encryption, one for each relay on the route.
- The client sends it to its entry relay, which removes the outer layer and passes it to a transit relay.
- The transit relay removes the next layer and passes it to the recipient’s mailbox relay.
- The mailbox relay removes the last layer and stores the end-to-end encrypted message under the recipient’s mailbox address for today.
- The recipient’s client collects it through its own entry relay, on a separate route, and decrypts it.
Who learns what
| Component | Sender’s address | Recipient | Content | Size and timing |
|---|---|---|---|---|
| Entry relay | Yes | No | No | Padded size, time sent |
| Transit relay | No | No | No | Padded size, time relayed |
| Mailbox relay | No | Today’s mailbox address only | No | Padded size, time stored and collected |
| Network observer | Yes, near the sender | Yes, near the recipient | No | Padded size and timing on the links it watches |
| Frothly | No | No | No | Only what its own relays see, as above |
Clients never choose two relays run by the same operator, in the same country or in the same network block for one route, so that no single organization or jurisdiction sees both ends.