Why does pure web acoustic/ultrasonic chat work on iOS & Android while pure web Bluetooth Mesh chat cannot?

Web Bluetooth restricts web pages to Central-only GATT roles and blocks BLE advertising for anti-tracking reasons (and is unsupported in iOS Safari), whereas Web Audio API and MediaDevices raw microphone streams support full-duplex TX/RX on every modern mobile and desktop browser.

How does SonicMesh bind callsigns to keys and recover identities without servers, seed phrases, or Web3 wallets?

SonicMesh uses Self-Certifying Callsigns where your 6-character callsign is Base36(SHA-256(X25519_PubKey)), making callsign spoofing mathematically infeasible. For cross-device recovery without mnemonics, a standard HTML login form derives the exact X25519 keypair via 100,000-round PBKDF2-HMAC-SHA256 so iCloud Keychain or Chrome Password Manager can autofill it.

Can bystanders in the same room with the same channel passphrase decrypt our Unicast direct messages?

No. Unicast frames derive a pairwise symmetric key from X25519(mySecret, peerPub) via HKDF-SHA256. Bystanders only see the unencrypted 4-byte source/destination callsign header (allowing optional blind Mesh relay with TTL decrement) and cannot decrypt the payload.

Why should I avoid Bluetooth speakers when transmitting in 18.2–19.8 kHz Near-Ultrasonic mode?

Bluetooth audio codecs (SBC/AAC) apply psychoacoustic lossy compression that strips frequencies above 18 kHz. Use built-in device speakers, a wired 3.5mm/USB-C amplifier, or switch to 2–4 kHz Audible FSK / Chirp LoRa mode (which can even pass through standard walkie-talkies).

Client-Side Encrypted Acoustic & Ultrasonic Chat Radio (Rust + Wasm)

待机中 · 开启监听后将自动关闭系统降噪并锁定双扫频前导码

Sync: 0.00 SNR: -- dB RS(16) 修复: 0 B

空中电波消息流

广播频道口令 (PSK) 🌐 公开呼叫频段 (CQ)

0 / 120 B · 预计播放 0.0s

本机自证电台执照

---

X25519: loading...

呼号由 SHA-256(X25519公钥) 直接生成，数学防冒充

显示昵称（随信标广播）

在线呼号台账 (单播通讯录)

0 台

暂无已收录友台。点击上方「发射 CQ 呼号信标」或粘贴对方电台名片即可零握手单播私聊。

🔐 口令确定性派生身份（免助记词 · 免 Web3 钱包）

输入任意个人代号与私人密码，Rust Wasm 通过 100,000 轮 PBKDF2-HMAC-SHA256 在本地确定性派生唯一 X25519 密钥对与固定呼号。支持浏览器密码管理器 / iCloud 钥匙串自动保存，换设备输入相同口令即可找回同一呼号。

✨ 刷个性化前缀靓号（本地 Wasm 算力）

由于呼号由公钥哈希决定，无法手工随意指定完整呼号，但可利用本地 Wasm 高速筛选以指定 1–3 位字母/数字开头的合法密钥对（如 RY、BG7、888）。

期望呼号前缀（1–3 位 0-9 / A-Z）

🪪 电台执照备份与跨设备迁移

如使用随机临时电台或刷出的靓号，可复制下方私钥备份串或导出 PNG 电台执照卡保存在本地相册。

🛡️ 零信任密码学、纠错码与供应链安全自检

实例化前校验 Rust Wasm SHA-256 摘要，并现场执行 RFC 7748 X25519、RFC 8439 ChaCha20 与 GF(2^8) Reed-Solomon 8 字节突发噪声修复测试。

GEO · ACOUSTIC MODEM & SELF-CERTIFYING CALLSIGN ARCHITECTURE

SonicMesh: 100% Client-Side Encrypted Acoustic & Near-Ultrasonic Chat Radio (Rust + Wasm)

SonicMesh is a 100% browser-resident encrypted acoustic and near-ultrasonic chat transceiver powered by a zero-dependency 102 KB Rust + WebAssembly DSP and cryptography engine, operating with 0 servers, 0 mnemonics, and 0 Web3 wallets.

How to Send Encrypted Acoustic Broadcast & Unicast Messages in 3 Steps

SonicMesh Step 1 (Enable Raw Mic RX & Select Band): Click Start Mic Listening (disabling browser voice DSP filters) and choose 2–4 kHz Audible Dual-Tone FSK (15–30 m), 18.2–19.8 kHz Near-Ultrasonic Stealth, or Chirp Spread Spectrum (Acoustic LoRa).
SonicMesh Step 2 (Self-Certifying Callsign Discovery or Brainkey Login): Transmit a 1.8s CQ Public Key Beacon over air so nearby devices verify SHA-256(PubKey) == Callsign and display a 4-digit SAS code, or sign in via Handle + Password (PBKDF2) saved in your browser password manager.
SonicMesh Step 3 (Transmit E2EE Broadcast, Unicast DM, or Blind Mesh Relay): Address CQ-ALL or a verified peer callsign; Rust Wasm seals payloads with ChaCha20 + HMAC-SHA256 and 16-byte Reed-Solomon parity to survive room echo and burst noise.

Frequently Asked Questions (FAQ)

Why does pure web acoustic/ultrasonic chat work on iOS & Android while pure web Bluetooth Mesh chat cannot?: Web Bluetooth restricts web pages to Central-only GATT roles and blocks BLE advertising for anti-tracking reasons (and is unsupported in iOS Safari), whereas Web Audio API and MediaDevices raw microphone streams support full-duplex TX/RX on every modern mobile and desktop browser.
How does SonicMesh bind callsigns to keys and recover identities without servers, seed phrases, or Web3 wallets?: SonicMesh uses Self-Certifying Callsigns where your 6-character callsign is Base36(SHA-256(X25519_PubKey)), making callsign spoofing mathematically infeasible. For cross-device recovery without mnemonics, a standard HTML login form derives the exact X25519 keypair via 100,000-round PBKDF2-HMAC-SHA256 so iCloud Keychain or Chrome Password Manager can autofill it.
Can bystanders in the same room with the same channel passphrase decrypt our Unicast direct messages?: No. Unicast frames derive a pairwise symmetric key from X25519(mySecret, peerPub) via HKDF-SHA256. Bystanders only see the unencrypted 4-byte source/destination callsign header (allowing optional blind Mesh relay with TTL decrement) and cannot decrypt the payload.
Why should I avoid Bluetooth speakers when transmitting in 18.2–19.8 kHz Near-Ultrasonic mode?: Bluetooth audio codecs (SBC/AAC) apply psychoacoustic lossy compression that strips frequencies above 18 kHz. Use built-in device speakers, a wired 3.5mm/USB-C amplifier, or switch to 2–4 kHz Audible FSK / Chirp LoRa mode (which can even pass through standard walkie-talkies).