About

Imported from WorkNFlow/ai-coffee-shop (.agents/skills/Security/implementing-end-to-end-encryption-for-messaging/SKILL.md). Install upstream with npx skills add WorkNFlow/ai-coffee-shop --skill implementing-end-to-end-encryption-for-messaging. Copyright stays with the author (Apache-2.0).

Implementing End-to-End Encryption for Messaging

Name: implementing-end-to-end-encryption-for-messaging
Author: WorkNFlow

Overview

End-to-end encryption (E2EE) ensures that only the communicating parties can read messages, with no intermediary (including the server) able to decrypt them. This skill implements a simplified version of the Signal Protocol's Double Ratchet algorithm, using X25519 for key exchange, HKDF for key derivation, and AES-256-GCM for message encryption.

When to Use

When deploying or configuring implementing end to end encryption for messaging capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Implement X25519 Diffie-Hellman key exchange for session establishment
Build the Double Ratchet key management algorithm
Encrypt and decrypt messages with per-message keys
Implement forward secrecy (compromise of current key does not reveal past messages)
Handle out-of-order message delivery
Implement key agreement using X3DH (Extended Triple Diffie-Hellman)

Key Concepts

Signal Protocol Components

Component	Purpose	Algorithm
X3DH	Initial key agreement	X25519
Double Ratchet	Ongoing key management	X25519 + HKDF + AES-GCM
Sending Chain	Per-message encryption keys	HMAC-SHA256 chain
Receiving Chain	Per-message decryption keys	HMAC-SHA256 chain
Root Chain	Derives new chain keys on DH ratchet	HKDF

Forward Secrecy

Each message uses a unique encryption key derived from a ratcheting chain. After a key is used, it is deleted, ensuring that compromise of the current state does not reveal previously sent/received messages.

Security Considerations

Delete message keys immediately after decryption
Implement message ordering and replay protection
Use authenticated encryption (AES-GCM) for all messages
Protect identity keys with device-level security
Verify identity keys out-of-band (safety numbers)

Validation Criteria

X25519 key exchange produces shared secret
Messages encrypt and decrypt correctly between two parties
Different messages produce different ciphertexts
Forward secrecy: old keys cannot decrypt new messages
Out-of-order messages can be decrypted
Tampered messages are rejected by authentication

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/worknflow-ai-coffee-shop-implementing-end-to-end-encrypt-9c8ef3/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

worknflow-ai-coffee-shop-implementing-end-to-end-encrypt-9c8ef3.ocm.jsonjson

{
  "ocm": "1",
  "id": "worknflow-ai-coffee-shop-implementing-end-to-end-encrypt-9c8ef3",
  "kind": "skill",
  "name": "implementing-end-to-end-encryption-for-messaging",
  "description": "End-to-end encryption (E2EE) ensures that only the communicating parties can read messages, with no intermediary (including the server) able to decrypt them. This skill implements a simplified version",
  "publisher": "WorkNFlow",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cryptography",
      "encryption",
      "e2e",
      "messaging",
      "signal-protocol",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "End-to-end encryption (E2EE) ensures that only the communicating parties can read messages, with no intermediary (including the server) able to decrypt them. This skill implements a simplified version"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/WorkNFlow/ai-coffee-shop",
      "path": ".agents/skills/Security/implementing-end-to-end-encryption-for-messaging/SKILL.md",
      "ref": "53283ef940cc61f7ffa5034c8101ef356a3e0226",
      "url": "https://github.com/WorkNFlow/ai-coffee-shop/blob/53283ef940cc61f7ffa5034c8101ef356a3e0226/.agents/skills/Security/implementing-end-to-end-encryption-for-messaging/SKILL.md",
      "key": "WorkNFlow/ai-coffee-shop/.agents/skills/Security/implementing-end-to-end-encryption-for-messaging/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing End-to-End Encryption for Messaging\n\n## Overview\n\nEnd-to-end encryption (E2EE) ensures that only the communicating parties can read messages, with no intermediary (including the server) able to decrypt them. This skill implements a simplified version of the Signal Protocol's Double Ratchet algorithm, using X25519 for key exchange, HKDF for key derivation, and AES-256-GCM for message encryption.\n\n\n## When to Use\n\n- When deploying or configuring implementing end to end encryption for messaging capabilities in your environment\n- When establishing security controls aligned to compli",
  "cost": {
    "context_tokens": 671
  }
}

Fetch it by URL: GET /api/v1/registry/worknflow-ai-coffee-shop-implementing-end-to-end-encrypt-9c8ef3/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.