Building Secure E2EE Network Sync for Linux: A Deep Dive into DotGhostBoard v1.5.1

Engineering the Nexus Release: How I Built Secure E2EE Network Sync into a Linux Clipboard Manager (v1.5.1)

DotGhostBoard v1.5.0 implements a privacy-first clipboard manager that syncs across Linux devices without a central server or cloud dependency. The system utilizes X25519 ECDH for key exchange and AES-256-GCM for payload encryption to ensure data remains secure on untrusted local networks.

Why This Matters

While local network discovery is often treated as a solved problem via mDNS, the technical reality of public Wi-Fi and ARP spoofing makes “local” synonymous with “untrusted.” This architecture moves beyond simple connectivity by implementing a zero-knowledge trust model where devices must prove identity through a human-verified PIN and ephemeral keys, contrasting with ideal models that assume LAN safety. This approach mitigates the risk of data interception on compromised routers or shared infrastructure, which is a critical failure point for traditional local sync tools.

Key Insights

• mDNS discovery via the zeroconf library enables zero-config device finding under the _dotghost._tcp.local. service type (2026).
• Secure pairing via X25519 ECDH ensures that shared secrets are derived locally and never transmitted in plaintext across the network.
• PyQt6 QThread integration prevents blocking network I/O from freezing the main UI thread during discovery and sync operations.
• Rate limiting pairing attempts (3 per 60s per IP) using a sliding window and threading.Lock mitigates brute-force attacks.
• Release integrity is maintained through GPG-signed AppImage and DEB artifacts to prevent supply chain tampering.

Working Examples

Core cryptographic functions for X25519 key generation and PBKDF2 key derivation used in the secure handshake.

import os
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import x25519
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def derive_handshake_key(pin: str, salt: bytes) -> bytes:
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=100_000,
    )
    return kdf.derive(pin.encode("utf-8"))

def generate_pairing_keys():
    private_key = x25519.X25519PrivateKey.generate()
    public_key_bytes = private_key.public_key().public_bytes(
        encoding=serialization.Encoding.Raw,
        format=serialization.PublicFormat.Raw
    )
    return private_key, public_key_bytes

Implementation of mDNS discovery using QThread to handle network I/O asynchronously from the PyQt6 UI.

from zeroconf import ServiceBrowser, Zeroconf, ServiceInfo, IPVersion
from PyQt6.QtCore import pyqtSignal, QThread

class DotGhostDiscovery(QThread):
    peer_found = pyqtSignal(str, str, str, int)
    def run(self):
        self.zeroconf = Zeroconf(ip_version=IPVersion.V4Only)
        instance_name = f"{self.node_id}._dotghost._tcp.local."
        self.info = ServiceInfo(
            type_="_dotghost._tcp.local.",
            name=instance_name,
            addresses=[socket.inet_aton(get_local_ip())],
            port=self.port,
            properties={'node_id': self.node_id}
        )
        self.zeroconf.register_service(self.info)
        self.browser = ServiceBrowser(self.zeroconf, "_dotghost._tcp.local.", self)

Practical Applications

• Use Case: P2P clipboard synchronization in air-gapped or high-privacy environments using local REST APIs. Pitfall: Failing to use threading.Lock on shared rate-limiter state leads to race conditions in concurrent handler threads.
• Use Case: Secure device pairing using out-of-band PIN verification to prevent Man-in-the-Middle (MITM) attacks. Pitfall: Relying on raw Python threads instead of QThread for UI updates causes race conditions and application instability in Qt-based apps.
• Use Case: Supply chain security for Linux binaries using GPG signing and SHA256 verification in CI/CD pipelines. Pitfall: dpkg-sig may hang in non-interactive CI environments without the —pinentry-mode loopback flag.

References:

• https://dev.to/freerave/engineering-the-nexus-release-how-i-built-secure-e2ee-network-sync-into-a-linux-clipboard-manager-3ocd
• https://github.com/kareem2099/DotGhostBoard