Deeplinks are encrypted using symmetric key encryption generated from a Diffie-Hellman key exchange. While deeplink sessions will be created in plaintext, an encrypted channel will be created to prevent session tokens from getting hijacked.
Phantom deeplinks are encrypted with the following workflows:
- 1.[dapp]: On the initial
connectdeeplink, dapps should include a
dapp_encryption_public_keyquery parameter. It's recommended to create a new x25519 keypair for every session started with
connect. In all methods, the public key for this keypair is referred to as
- 2.[phantom]: Upon handling a
connectdeeplink, Phantom will also generate a new x25519 keypair.
- Phantom will return this public key as
- Phantom will create a secret key using Diffie-Hellman with
dapp_encryption_public_keyand the private key associated with
- Phantom will locally store a mapping of
dapp_encryption_public_keyto shared secrets for use with decryption in subsequent deeplinks.
- 3.[dapp]: Upon receiving the
connectresponse, the dapp should create a shared secret by using Diffie-Hellman with
phantom_encryption_public_keyand the private key associated with
dapp_encryption_public_key. This shared secret should then be used to decrypt the
datafield in the response. If done correctly, the user's public key will be available to share with the dapp inside the
- 2.[phantom]: Upon approval, Phantom will encrypt the signed response as a JSON object with the encryption sent as a
- 3.[dapp]: Upon receiving the deeplink response, dapps should decrypt the object in the
data=query param to view the signature.
To learn more about encryption and decryption, please refer to the following libraries: