Atlas Associates
KEY SYNC

Secure Device-to-Device Key Transfer

Transfer your encryption keys to a new device using QR codes. X25519 ECDH key exchange + AES-256-GCM encrypted transfer.

1

Source Device

On the device that has your keys: Settings β†’ Key Sync β†’ "Transfer Keys". A QR code is displayed (valid for 5 minutes).

2

Target Device

On your new device: After login, select "Scan QR" and scan the QR code from the source device with your camera.

3

Transfer Complete

Keys are securely transferred via encrypted channel. SHA-256 checksum verifies data integrity. Session auto-expires.

Transfer Protocol

Source Device                        Target Device
     β”‚                                    β”‚
     β”‚  1. Create Session (Firestore)     β”‚
     β”‚  2. Generate X25519 Ephemeral Key  β”‚
     β”‚  3. Display QR Code               β”‚
     β”‚          ─── QR Scan ───►          β”‚
     β”‚                                    β”‚  4. Parse QR β†’ sessionId + publicKey
     β”‚                                    β”‚  5. Generate X25519 Ephemeral Key
     β”‚                                    β”‚  6. ECDH β†’ Shared Secret
     β”‚                                    β”‚  7. HKDF-SHA256 β†’ AES Key
     β”‚          ◄── Firestore ──          β”‚  8. Write encrypted response
     β”‚  9. ECDH β†’ Same Shared Secret     β”‚
     β”‚  10. Encrypt keys (AES-256-GCM)   β”‚
     β”‚          ── Firestore ──►          β”‚
     β”‚                                    β”‚  11. Decrypt β†’ Import keys
     β”‚                                    β”‚  12. SHA-256 Checksum verify
     β”‚  13. Cleanup session               β”‚
     β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
              Session TTL: 5 minutes

Keys Transferred

KeyAlgorithmPurpose
Identity Key PairX25519Identity verification / PQXDH
Signing Key PairEd25519Message signatures (AEGIS XEdDSA)
Signed PreKey PairX25519X3DH session establishment
Registration IDβ€”Session identifier

One-Time PreKeys are NOT transferred. They are regenerated on the new device to avoid key competition between devices.

Platform Support

PlatformQR ScanKey StorageAlternative
iOSSupportedKeychainβ€”
AndroidSupportedAndroid Keystoreβ€”
macOSCamera dependentKeychainRegenerate Keys
PWA (Web)Camera permission dependentWeb Crypto APIRegenerate Keys

Regenerate Keys: If QR scanning is unavailable (PWA/macOS), choose "Regenerate Keys" to create new encryption keys. New sessions will be established with all contacts, but previous messages cannot be decrypted.

Multi-Device Usage

Important considerations when using the same account on multiple devices.

Same Account, Multiple Devices

  • β€’ Each device stores independent encryption keys
  • β€’ Key Sync required to decrypt messages from original device
  • β€’ One-Time PreKey conflicts possible with simultaneous devices
  • β€’ Device limit: Essential 1 / Premium & Intelligence 3

Different Account, Same Device

  • β€’ All encryption sessions fully reset
  • β€’ Previous account messages permanently undecryptable
  • β€’ No key collision between different accounts
  • β€’ Warning dialog shown before account switch

Arc vs Signal: Multi-Device Model

FeatureSignalArc V2
Device ModelPrimary/LinkedIndependent key sets
Device AdditionVia PrimaryDirect registration + Key Sync
Key DistributionPrimary distributes to LinkedPeer-to-peer QR exchange
Device AuthenticationImplicit trustEd25519 signature verification
Primary FailureAll Linked devices orphanedNo impact (independent)