Layer 1: The Armoured Transport
Securing the Channel
The first layer of Cellcrypt's defence is the protection of the communication channel itself. Think of this as an armoured truck purpose-built to transport a locked safe. The truck's armour protects the transport process from external attack and surveillance, ensuring the safe arrival at its destination without interference.
Technologically, this is achieved by encapsulating all data-in-transit within a robust, Common-Criteria compliant TLS 1.3 tunnel. This secure channel protects all communication between the Cellcrypt client application and the server infrastructure, whether it is our cloud service or a customer's on-premises deployment. The specific cryptographic suites used are of the highest standard, such as
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, as documented in our Common Criteria security validation reports.
This armoured transport layer is specifically designed to defeat network-level attacks, including passive eavesdropping and active Man-in-the-Middle (MiTM) attacks, which are common threats on public Wi-Fi or compromised cellular networks.22 It protects critical signalling information, user authentication credentials, and prevents adversaries from performing traffic analysis on the connection.
Layer 2: The Safe
True End-to-End Encryption
Inside the armoured transport is the second, and most critical, layer of defence: the quantum-resistant safe. This is the true end-to-end encryption (E2EE) that protects the content of your communications. Even if an adversary were to hijack the armoured truck (i.e., compromise the network), the contents of the safe—your voice calls, video conferences, messages, and files—would remain impenetrably secure.
All user content is additionally protected by this separate E2EE layer, utilising protocols such as the Secure Real-time Transport Protocol (SRTP) for voice and video calls.20 The cryptographic keys for this E2EE layer are generated, managed, and held exclusively by the endpoints (the users' devices). These keys are ephemeral, created for each new session and destroyed afterwards, and are never accessible to the Cellcrypt server infrastructure
The foundation of our E2EE is built upon the strongest and most proven classical cryptographic algorithms, certified by the National Institute of Standards and Technology (NIST) and trusted by governments worldwide. We utilise a robust combination of:
Elliptic Curve Cryptography (ECC P-521): Used for digital signatures and key agreement, providing robust security with efficient performance.
AES-256 and ChaCha20: For symmetric encryption of the data stream. We uniquely combine both AES (in CTR/GCM mode) and ChaCha20, using separate keys for each.1
This classical foundation is the basis for our 20-year history of providing certified secure communications for the most demanding government, military, and enterprise clients.1
Layer 3: The Quantum-Resistant Shield
Future-Proofing Your Data