← Home
Download Free Switch to Italian

Security

WFAS security architecture, from encryption to authentication, designed for local networks.

Three-level authentication

None

For networks already considered secure and trusted (e.g., your own home). Devices connect immediately.

Manual approval

Any new device attempting to connect is blocked and requires your manual confirmation on the server screen.

Shared key

Devices prove to each other that they know the same key, without it ever being transmitted in plain text over the network.

Uses challenge-response based on HMAC-SHA256.

End-to-End Encryption

Audio transmitted over the native protocol can be fully end-to-end encrypted with ChaCha20-Poly1305, a fast and secure cryptographic standard defined by the IETF (RFC 8439). Select Key security mode on the Send (Server) screen, set your passphrase, and turn on the encryption switch toggle.

Anti-replay protection

In addition to encryption, audio packets that are duplicated, out of order, or intentionally replayed by a malicious actor on the local network are recognized via timestamps and automatically discarded by the receiver.

SENDER RECEIVER ENCRYPTED REPLAY PKT
void wfas_encrypt (packet* p) { chacha20_poly1305_seal ( p->data , p->len, shared_key , p->nonce ); } bool verify_auth (client* c) { return hmac_sha256 ( c->challenge , key ) == c->response; } void wfas_encrypt (packet* p) { chacha20_poly1305_seal ( p->data , p->len, shared_key , p->nonce ); } bool verify_auth (client* c) { return hmac_sha256 ( c->challenge , key ) == c->response; }

Total transparency

We don't ask you to just take our word for it. The entire specification of the WFAS v2 protocol, including all cryptographic details, handshake phases, and primitives used, is public and available for anyone to inspect.

Read the full specification on GitHub →

Declared limits

Let's be honest: perfect security doesn't exist. In Multicast streaming mode, encryption relies on a static key shared in advance among all clients. This makes it suitable for a trusted home network, but it is not intended or recommended for public, corporate, or untrusted Wi-Fi networks.

Privacy

Read the full privacy policy →
Security & Encryption Notice

The optional WFAS encryption feature is provided "AS IS" and is intended primarily as a lightweight privacy and traffic-protection layer for trusted local networks (LAN/P2P).

It is not intended to provide protection against high-threat attackers, hostile networks, or security-critical environments, and it should not be relied upon as a substitute for a dedicated secure transport or other security mechanisms where stronger guarantees are required.

Users and integrators are responsible for evaluating whether WFAS's security properties and their network environment are appropriate for their intended use.

The WFAS protocol and its reference implementations are provided under the terms of their respective open-source licenses. No additional security guarantees are implied beyond those explicitly documented by the protocol and implementation.

Security issues should be reported to the project maintainers so they can be investigated and addressed in future releases.