Reference

Call protocol

A call is three control planes, one media path, and layered encryption. The default contact-call path holds media until its fingerprint authentication and frame-crypto gates pass. A separately enabled, visible classical fallback changes the frame-crypto condition.

Versioned reference

On this page

Three control planes

Control layers

Room signaling

The server reads invitations, SDP, ICE candidates and TURN credentials.

Endpoint AServerEndpoint B

Ratchet control

Encrypted messages authenticate fingerprints and carry frame keys, rotation and caller proofs.

Endpoint ADouble RatchetEndpoint B

Live control

Quality reports and selected live controls use epoch keys derived from the frame key.

Endpoint ASealed live controlsEndpoint B

Media is a separate path

Audio and video frames are encrypted at the endpoints, then carried inside DTLS-SRTP over a direct or TURN-relayed connection.

Before release: authenticate the DTLS fingerprint and attach frame crypto, unless the user accepts the visible classical fallback.

B and C show control layers, not direct network routes. The frame-key host is the endpoint with the smaller Auris ID; either endpoint can hold that role. Auris does not use a WebRTC data channel.

Plane A: room signaling: JSON over the pinned WebSocket, relayed by the server: the invitation, the offer and answer, ICE candidates, TURN credentials, hangup. The server reads all of it. Its from, room and attempt fields are server assertions and may never name a caller; a legacy name field is parsed and discarded at the door. Untrusted by construction.
Plane B: ratchet control: Controls carried end to end inside ordinary encrypted messages: the DTLS fingerprint announcement, the entire frame-key protocol, the caller-attempt proof, the callee's ring acknowledgement, captions and caption requests, screenshot notices. Identity-bound by the ratchet; sender binding and archived-session rules run before any control is handled.
Plane C: live control channel: Four frame kinds (a capability hello, receiver quality samples, a redundancy re-offer request, and long-term-reference acknowledgements) are sealed under epoch keys that are a pure derivation of the frame key, with per-epoch sequence numbers. Frame-key rotation does not ride here; it is a plane-B control.

The fail-closed invariants

Media hold
Contact media is released only after two independent gates settle: the peer's DTLS certificate fingerprint was authenticated over the ratchet and matches the SDP the server delivered; and frame crypto attached (or the user explicitly accepted the visible classical fallback). These checks are intended to reject a server-substituted media endpoint before release, assuming correct identity binding and implementation.
Fingerprint verdicts
incomplete keeps waiting. verified releases the identity gate once. unattributable (a mismatch on an announcement not bound to this dial's attempt id) stays unverified and never condemns the call. tampered (a bound announcement that does not match the signaling-delivered fingerprint) is a hard teardown: "security check failed". A changed remote fingerprint mid-call is treated the same way, because a certificate is fixed for a connection's lifetime.
Watchdogs anchored at real connection
Security deadlines start when the transport actually connects, so slow ICE is never misread as a failed authentication. The held-media deadline is 15 seconds; a contact call whose fingerprint never arrives is killed at 20 seconds, with one 40-second grace window for an identified contact answering from a cold push wake.
Signaling is untrusted
A valid short-lived, per-attempt MAC hint can authorise a locally resolved name before the full ratchet proof arrives. Legacy hints are routing hints only. Durable attribution and direct-path admission require stronger checks. Room admission at the server is bearer-only, which is precisely why the client fails closed on silence.

The frame-crypto session

Once both applied SDP fingerprints exist, the frame handshake runs concurrently with transport setup, authentication first. The session id is a role-ordered hash over both DTLS certificate fingerprints, stable on both phones for exactly this connection; every control carries the attempt id and that session id. The host (the smaller Auris ID) mints a random AES-256 frame key and retries until the viewer confirms; a key-fingerprint field binds every later control to the exact acknowledged key.

Each encoded audio and video frame is then sealed with AES-GCM under that key with an 8-byte prefix [keyId:1][counter:7], in disjoint nonce domains per stream and direction (audio 0/1, video 2/3) to separate counter spaces. Security still requires the counter, key-id and lifecycle implementation to respect that separation. Video negotiates raw packetization and a generic frame descriptor, which carries frame boundaries on the wire and doubles as the frames' authenticated data; the receiver copies ciphertext before opening it. Transport encryption (DTLS-SRTP) wraps all of it.

Mid-call rotation. The host polls the ratchet's fold counter and, whenever a qualified post-quantum fold has landed (at most every thirty seconds), mints a fresh frame key and walks a three-step dance over the ratchet. The decryptor holds the current and previous key so in-flight frames survive the swap; an unknown key id is a hard drop; a rotation failure keeps the current key without tearing down the call. A fold needs message traffic, so rotation happens only as often as the conversation actually ratchets.

Setup, ringing and relay policy

A dial sends the invitation over plane A and, at the same moment, an encrypted caller-attempt proof over plane B containing only the random attempt id and a caller-set validity window. The ratchet proof must bind the peer, attempt and validity window. A separate per-attempt MAC hint can permit early name display from the callee’s own contacts. The ordinary payload contains no plaintext contact name; hint authentication does not replace the full proof for every decision. TURN credentials are minted per admitted attempt (a fresh capability derived from the attempt and blinded room, granted only after the caller's authenticated invite is admitted) so the identity-free call socket never carries an account id.

Incoming direct connections are proof-gated: a callee gathers direct ICE candidates only once the exact attempt is ratchet-proven and the contact's own settings allow it; every gap fails private, to relay. Since build 144 a proof that authenticates after the answer releases that one call's relay pin with a single ICE restart (the same evidence at a later moment) while every standing pin (the global hide-IP switch, Lockdown, a relay adopted for cause, the throttle-detected TCP pin) stays untouched. The server’s routing assertion alone is insufficient to admit an incoming direct path; the additional proof gate is intended to prevent that address-harvesting attack.

The media engine

Audio: exact Opus 1.6.1 with in-band FEC, neural deep-PLC and OSCE concealment, and DRED redundancy; adaptive packet time; Apple's hardware echo cancellation fed in through a custom audio device with WebRTC's own canceller off.
Video: hardware HEVC through a custom low-latency pipeline; an app-level resolution ladder (270p to 1080p) that steps down instantly and up one rung per eight seconds of headroom; a bufferbloat guard that clamps video hard when a cellular uplink starts queueing; long-term reference frames and temporal layering.
Recovery: a liveness watchdog and ICE restarts spaced 6.25 seconds apart; a 45-second reconnect window, extended by 20 seconds on verified progress, 90 seconds hard; starvation verdicts that distinguish startup from established calls and are aware of discontinuous transmission and concealment; a path re-prove hold after a network change so a stale bandwidth profile is not carried onto a new path.
Relay as a quality lever: anycast TURN can split one long congested loop into two short clean ones and beat direct on a bad intercontinental path; evidence of a relay-only path is remembered per network kind (Wi-Fi, cellular) for seven days, never per network, so no SSID or address is stored.

What each observer sees during a call

Observer	Sees	Content boundary
The server	The caller→callee edge at invite; the blinded room (links repeat calls within one day); the SDP and ICE candidates in the clear, including candidate addresses; timing and duration	Media; the frame key; the caller's name; the fingerprint proof's meaning (integrity is enforced end to end even though the SDP is readable)
A TURN relay	Both endpoints' addresses, volumes, timing, duration	Content encrypted at both layers
Your contact	Your IP on a direct call (as with any peer-to-peer app), unless you hide it	Not applicable
Your network	Call-shaped traffic to a peer or a relay; packet sizes and timing	Content
Apple	Device token, timing, room and hint; first-contact fallback may include the caller’s opaque ID	No plaintext contact name in the ordinary push; identity and relationship inference remain possible

Honest scope

The frame key inherits the ratchet's post-quantum story, but the complete call composition (ratchet, frame layer, rotation, DTLS) is not proved. Mid-call rotation is an implemented recovery mechanism, not a proof of immediate bidirectional healing.
A per-user opt-in allows a visible classical-only fallback (labelled "Not quantum-secure") for very poor networks; it is never silent and either side can refuse it.
Traffic shape can carry information about speech. Even under two authenticated-encryption layers, packet sizes and timing can expose activity and structure. No quantified Auris speech-inference bound is established here. A traffic-shaping design for calls (pad to buckets rather than constant bitrate) is specified and partially built; it is research, not a shipped property, and no posture shapes call traffic today.
The DTLS parser is network-reachable before authentication, bounded by ICE consent; a transcript-bound frame-key derivation and the standard SFrame wire format (RFC 9605) are possible hardening work, not claims of implemented SFrame conformance.

The plain-language version is calls in the guide.

Reviewed 2026-09-05 · Review scope and versions