> ## Content Index
> Fetch the complete content index at: https://z-text.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# ⚛️ Z-TEXT Full Security Stack — Technical Reference
- URL: https://z-text.org/z-text-full-security-stack-technical-reference/
- Published: 2026-05-06T12:55:06.000Z
- Updated: 2026-05-06T12:55:06.000Z
- Author: Eric Pierrot - Founder, Z-TEXT LLC — building privacy tools without phone numbers, email, or metadata.

Technical Security Bulletin

# ⚛️ Z-TEXT Full Security Stack — Technical Reference 

zk-SNARKs · X25519/Ed25519 · Serverless architecture · NIST FIPS 203 ML-KEM-768 — live in production 

The current [Z-TEXT](https://z-text.com/?ref=z-text.org) website under-represents what the stack actually delivers. This post documents the full cryptographic architecture as deployed — for developers, auditors, and security-conscious users who want the complete picture. 

🛡️ Layer 1 — BitcoinZ Sapling zk-SNARKs (On-Chain Metadata Shield) 

Every Z-TEXT message is transmitted as a **shielded transaction on the BitcoinZ blockchain** using the Sapling zk-SNARKs circuit — the same primitive deployed by Zcash. This cryptographically hides sender address, receiver address, memo content and transaction amount from all on-chain observers, including validators and full nodes. 

| Proof system     | Groth16 (Sapling)                             |
| ---------------- | --------------------------------------------- |
| Proof size       | < 200 bytes — mobile-verified in milliseconds |
| Address type     | z-address (zs1…) — shielded by default        |
| Chain live since | 10 September 2017 — 8 years proven uptime     |

Reference: [Electric Coin Company — What are zk-SNARKs?](https://z.cash/learn/what-are-zk-snarks/?ref=z-text.org) | [Wikipedia — Zero-knowledge proof](https://en.wikipedia.org/wiki/Non-interactive%5Fzero-knowledge%5Fproof?ref=z-text.org) 

🔐 Layer 2 — X25519 + Ed25519 Classical End-to-End Encryption 

The message body is encrypted end-to-end using **X25519** (Elliptic Curve Diffie-Hellman key agreement, Curve25519) for key exchange and **Ed25519** (Edwards-curve Digital Signature Algorithm) for message authentication. Both are IETF-standardised, formally audited and deployed in production security systems globally for over a decade. 

| Key exchange   | X25519 (RFC 7748)                 |
| -------------- | --------------------------------- |
| Signature      | Ed25519 (RFC 8032)                |
| Payload cipher | AES-256-GCM                       |
| Standard       | IETF — audited globally 10+ years |

Reference: [Wikipedia — Curve25519](https://en.wikipedia.org/wiki/Curve25519?ref=z-text.org) | [IETF RFC 7748](https://datatracker.ietf.org/doc/html/rfc7748?ref=z-text.org) 

🚫 Layer 3 — Serverless, Accountless, Zero-Data Architecture 

Z-TEXT has no central servers, no user accounts, no central database and no entity that can be subpoenaed for user data. Messages travel device-to-device via shielded blockchain transactions. The user holds the 24-word seed phrase — the sole key to identity, messages, wallet and password vault. Nothing to breach. Nothing to hand over. 

| Message routing | G-stream mempool push — 1 to 5 seconds            |
| --------------- | ------------------------------------------------- |
| Identity system | Cryptographic z-address only — no phone, no email |
| Key custody     | User-held 24-word seed phrase — self-custodial    |
| Legal exposure  | No central entity to subpoena                     |

✅ Live in Production

⚛️ Layer 4 — NIST FIPS 203 ML-KEM-768 Post-Quantum Key Encapsulation 

Z-TEXT now optionally wraps the classical X25519 key exchange with **ML-KEM-768** (Module Lattice Key Encapsulation Mechanism, formerly CRYSTALS-Kyber), standardised as NIST FIPS 203 in August 2024\. This provides resistance against Shor's algorithm attacks from quantum computers — protecting messages today against a "harvest now, decrypt later" threat model. 

| Standard         | NIST FIPS 203 (August 2024)                    |
| ---------------- | ---------------------------------------------- |
| Algorithm family | Module Lattice (CRYSTALS-Kyber)                |
| Security level   | ML-KEM-768 — NIST Level 3 (AES-192 equivalent) |
| Hybrid mode      | ML-KEM-768 + X25519 combined                   |
| Status in Z-TEXT | ✅ Live — not a roadmap item                    |

Reference: [NIST FIPS 203 — ML-KEM Standard](https://csrc.nist.gov/pubs/fips/203/final?ref=z-text.org) | [Wikipedia — CRYSTALS-Kyber](https://en.wikipedia.org/wiki/Kyber?ref=z-text.org) 

📊 Full Stack — Competitive Matrix

| Layer                    | Z-TEXT   | Signal     | WhatsApp | Telegram |
| ------------------------ | -------- | ---------- | -------- | -------- |
| zk-SNARKs metadata       | ✅        | ❌          | ❌        | ❌        |
| X25519 + Ed25519 E2E     | ✅        | ✅          | ✅        | ⚠️       |
| Serverless / no accounts | ✅        | ❌          | ❌        | ❌        |
| ML-KEM-768 post-quantum  | ✅        | ⚠️ PQ only | ❌        | ❌        |
| All 4 combined           | ✅ Unique | ❌          | ❌        | ❌        |

**Signal has post-quantum encryption — but runs on centralised servers.** That means metadata (who talks to whom, when, how often) can be logged and subpoenaed. The serverless + zk-SNARK + classical + post-quantum combination is, to our knowledge, unique to Z-TEXT. 

⚛️ Post-Quantum — How It Works in Practice

Optional Full PQ Protection — Per Contact, One Tap 

ML-KEM-768 post-quantum protection in Z-TEXT is **opt-in per contact**. This is a deliberate design choice — not a limitation. The user decides which conversations get the full quantum shield, with a single tap to initiate a PQ handshake with each contact. 

This matters especially for the **"harvest now, decrypt later"** threat model — where adversaries record encrypted traffic today, intending to decrypt it once quantum computers become powerful enough. Activating PQ per contact closes that window permanently for that conversation. 

| 1️⃣ | Open any contact in Z-TEXT Standard messages already protected by Layers 1–3                                              |
| --- | ------------------------------------------------------------------------------------------------------------------------- |
| 2️⃣ | Tap — Activate Post-Quantum for this contact Z-TEXT performs ML-KEM-768 key encapsulation handshake                       |
| 3️⃣ | All future messages to that contact — full 4-layer protection zk-SNARKs + X25519/Ed25519 + serverless + ML-KEM-768 active |

⚠️ Important — PQ Keys & Portability

ML-KEM-768 session keys are **not derived from your 24-word seed phrase**. This is a property of lattice-based cryptography — the key material cannot be deterministically regenerated from a seed. As a result, PQ handshakes are **device-bound**: if you reinstall Z-TEXT or move to a new device, a one-tap re-handshake with each contact is required to restore full PQ protection. Your messages, wallet and password vault remain fully recoverable via seed — only the PQ session layer needs re-establishing. 

✅ Without PQ handshake — still strongly protected

Contacts without an active PQ handshake continue to receive full protection from the three base layers: zk-SNARKs metadata shielding, X25519 + Ed25519 end-to-end encryption, and the serverless zero-data architecture. The PQ layer is additive — its absence does not weaken existing protection. 

PQ Portability — Z-TEXT vs Others

| Aspect                     | Z-TEXT          | Signal      |
| -------------------------- | --------------- | ----------- |
| PQ live in production      | ✅               | ✅           |
| No central server required | ✅               | ❌           |
| Metadata hidden on-chain   | ✅               | ❌           |
| PQ derivable from seed     | ❌ by design     | ❌ by design |
| Re-handshake on new device | 1 tap / contact | Automatic\* |

\* Signal re-handshake is automatic because it uses central servers to coordinate — which is precisely what Z-TEXT eliminates.

Reference: [NIST FIPS 203 — ML-KEM](https://csrc.nist.gov/pubs/fips/203/final?ref=z-text.org) | [Wikipedia — CRYSTALS-Kyber](https://en.wikipedia.org/wiki/Kyber?ref=z-text.org) 

⛓️ BitcoinZ Chain — Track Record

| Genesis block | 10 September 2017                |
| ------------- | -------------------------------- |
| Years live    | 8 years — no chain halts         |
| Privacy model | Sapling zk-SNARKs — no premine   |
| Governance    | Community-driven — decentralised |

Source: [getbtcz.com](https://getbtcz.com/?ref=z-text.org) | [Wikipedia — BitcoinZ](https://en.wikipedia.org/wiki/BitcoinZ?ref=z-text.org) 

[🚀 Get Pre-Licence Voucher — Z-TEXT.com ](https://z-text.com/packages?ref=z-text.org) 

Open source · Self-custodial · 3-in-1: Messenger + Wallet + Password Manager 

quantum proof messaging app · ML-KEM-768 messenger · NIST FIPS 203 messenger · zk-SNARKs secure chat · X25519 encrypted messenger · decentralized encrypted messenger · blockchain messaging privacy · zero-knowledge proof messenger · Signal alternative · best private messaging app · no phone number messaging app · censorship resistant messenger · post-quantum secure chat · stealth mode chat app · on-chain messaging solution