A Glossia identity is a long-term key pair, generated on the person’s first device and never sent anywhere. Everything else a person publishes is signed by it.
| Key | Algorithm | Lifetime | Purpose |
|---|---|---|---|
| Identity key | Ed25519, with an X25519 form | Permanent | Signs device keys and prekeys; takes part in every handshake. |
| Device key | Ed25519 | Until the device is unlinked | Identifies one device. Signed by the identity key. |
| Signed prekey | X25519 | Rotated weekly | Lets others start a conversation while the device is offline. |
| One-time prekeys | X25519 | Used once | Adds forward secrecy to the first message. |
| Post-quantum prekey | ML-KEM-768 | Rotated weekly | Protects the handshake against future quantum computers. New in 4.0. |
Devices
A person may link up to five devices to one identity. Linking requires the new device to scan a code shown on an existing one; the existing device signs the new device key and sends it the identity’s contact list, encrypted end to end. Unlinking a device revokes its key, ends its sessions and invalidates its session resumption tokens at every relay.
Prekey bundles
Each device uploads a prekey bundle to its mailbox relay: its device key, a signed prekey, a signed post-quantum prekey and up to 100 one-time prekeys. A client starting a conversation fetches the bundle, checks every signature against the identity key and MUST refuse a bundle whose post-quantum prekey is missing or unsigned, unless the conversation is in 3.x compatibility mode (see Versions and downgrade protection).
Safety numbers
Two people can confirm that nobody is intercepting their conversation by comparing a safety number: 48 digits derived from both identity keys, shown in twelve groups of four and as a scannable code. The number is the same on both phones and changes only if one of them gets a new identity key. Clients MUST warn when a contact’s safety number changes, and MUST NOT allow screenshots of the safety number screen.