OwnWire White Paper

OwnWire: Zero-Visibility Payload Transport for Web Messaging and AI Workflows

Executive Summary
Most modern applications rely on HTTPS/TLS, but in real-world deployments TLS is often terminated by intermediaries such as CDNs, WAFs, load balancers, API gateways, and service meshes. Once TLS terminates, sensitive data may be visible to infrastructure components, logs, and operators that are not the application itself.

This problem is amplified in AI systems, where prompts, retrieved documents, embeddings, and responses often contain proprietary or regulated data. OwnWire reduces this exposure by encrypting message payloads at the application layer so that intermediaries see ciphertext only. Decryption happens only inside the OwnWire runtime and is forwarded privately to an internal client.

Problem Statement
TLS protects data in transit between two endpoints, but in modern architectures the “endpoint” is often infrastructure rather than the application. This creates a large trust surface. AI pipelines multiply this problem because data flows through many services, each a potential leakage point.

What OwnWire Does
OwnWire adds application-layer payload encryption on top of WebSockets. Messages are encrypted before traversing infrastructure and decrypted only at a controlled private boundary. OwnWire exposes a public WebSocket for browsers/SDKs and a private internal WebSocket for backend or LLM clients.

Implementation Overview
OwnWire uses ephemeral ECDH on P-256 (or more secure X25519) to establish a per-session shared secret. Keys are derived using HKDF-SHA256 and used with AES-256-GCM for message encryption. Each message includes a random salt and sequence number to ensure nonce uniqueness and prevent replay.

Decryption and Trust Boundary
Payloads are decrypted only inside the OwnWire runtime and forwarded as plaintext over a private internal interface, typically bound to localhost. Plaintext exists only where computation occurs and is not exposed to proxies, logs, or observability systems.

Security Properties
OwnWire prevents intermediaries such as CDNs, WAFs, load balancers, and logging layers from accessing payload contents. Infrastructure can route traffic but cannot read it.

Limitations
OwnWire does not protect against a fully compromised host running OwnWire or the internal client. Metadata outside the encrypted payload may still be visible unless explicitly encrypted by the application.

Compliance Impact
By reducing the number of systems that can access sensitive payload data, OwnWire supports data minimization principles and simplifies SOC 2, GDPR, and CCPA narratives.

Conclusion
OwnWire addresses a practical gap in modern systems where TLS alone is insufficient. By encrypting payloads at the application layer and decrypting only at a controlled boundary, OwnWire reduces leakage surface and makes secure AI messaging practical.