A private channel
over a relay that can't read it.
The shared-world channel is public by design — every participant sees the same world.
A private channel needs one more thing: confidentiality from the relay itself. This tab
forms a real MLS group (RFC 9420), derives a shared SFrame key (RFC 9605) from the
group's exporter secret, and seals each object payload before it ever hits the wire. Type a
message: it is sealed, published to the live MoQ relay, and comes back — the relay
forwarded, and signed a moq-jwp receipt over, only ciphertext. A group member
decrypts it; a non-member's key is rejected by the AEAD. The plaintext never leaves your
browser. This is Track::e2e_encrypted — MLS + SFrame per
draft-jennings-moq-e2ee-mls, all in WASM.
What just happened
Two members ran an MLS handshake (KeyPackage → Welcome → join) and each derived the
same 32-byte SFrame base key from the group's exporter secret — a non-member derives a
different key and is shown alongside. Your message was sealed with AES-256-GCM under a
per-message nonce, published to the same relay that carries the public world, and
delivered back with a signed moq-jwp receipt (Ed25519 + Merkle + joules). The relay
attested delivery, integrity, and energy of the object — without ever seeing the
plaintext. The member opened it; the non-member's AEAD tag failed. Confidentiality from the
relay, integrity + provenance + metering from moq-jwp, group keys from MLS: end-to-end secure
media over QUIC, the composition from draft-jennings-moq-e2ee-mls. The byte-level
framing, key schedule, and MLS binding are the
Confidentiality sub-spec;
reference implementation in the open-standards repo, Apache-2.0.