QSDN Deniable Encryption Format Specification

File extension .qsdn · Internal media type application/vnd.quantumsequrity.qsdn (NOT submitted to IANA) · Version 2 · Last updated May 2026

1. Overview

QSDN is a deniable encryption variant of the QNSQY format. A QSDN file contains two or more independently encrypted partitions, each unlocked by a different password or key. From the ciphertext alone, an observer cannot distinguish whether one or multiple partitions exist or which partition is the "real" plaintext. This provides plausible deniability under coercion.

QSDN is intended for situations where users may be compelled to disclose a decryption key (border-crossing scenarios, hostile threat environments). The format is designed so that disclosing one key reveals only the partition associated with that key.

Registration scope. QSDN is an internal sub-format of QNSQY tooling. Only the primary .qs format is being submitted to IANA for media-type registration; the application/vnd.quantumsequrity.qsdn string above is a vendor-tree identifier under our control but is not an IANA-listed media type and is not in the process of becoming one.

Compliance notice. Deniable encryption is incompatible with regulatory regimes that require records to be preserved unmodified and verifiable, including FDA 21 CFR Part 11 §11.10(e), Sarbanes-Oxley electronic record retention, and certain HIPAA audit-trail requirements. The QNSQY reference implementation refuses to read or write QSDN files when run in --regulated-mode or --fips-mode. Organizations subject to these regulations SHOULD NOT use QSDN.

2. File identification

PropertyValue
Magic bytes51 53 44 4E (ASCII "QSDN")
Magic offset0
File extension.qsdn
Media typeapplication/vnd.quantumsequrity.qsdn
EndiannessLittle-endian
Maximum partitions16

3. File layout

offset 0 : 4 bytes QSDN magic (51 53 44 4E) : 1 byte Format version (currently 0x02) : 1 byte Partition count (1–16) : 2 bytes Header reserved (zero) : 32 bytes Argon2id global salt : 4 bytes Argon2id memory KiB (LE u32) : 1 byte Argon2id iterations : 1 byte Argon2id parallelism : 14 bytes Reserved (zero) : : Per partition (repeated N times): : 4 bytes Partition slot magic "QSDP" (51 53 44 50) : 8 bytes Partition ciphertext length (LE u64) : 32 bytes Partition AEAD nonce : 16 bytes Partition AEAD tag : N bytes AEAD ciphertext (a complete .qs file) : : All partitions are constant-padded to a uniform block size : so that an external observer cannot determine which slot : holds the real plaintext.

4. Plausible deniability semantics

QSDN's deniability holds under the following assumptions:

  • The user creates each partition with an independently generated key not derivable from the others.
  • The user pads decoy partitions with realistic-looking data (random documents, stock photos, throwaway notes).
  • The adversary does not have access to side-channel information (residual files, memory dumps, OS swap files) that would reveal multiple partitions exist.
  • The user has not previously disclosed the existence or count of partitions.

QSDN does NOT provide deniability against adversaries who can observe runtime memory, force the user to decrypt all slots, or perform forensic analysis of the user's device.

5. Security considerations

QSDN ciphertext is indistinguishable from random data above the 56-byte fixed header. Each partition is independently AEAD-protected; tampering with one partition does not affect the others. Implementations MUST validate the QSDN magic bytes, version, and partition count before parsing further. Implementations MUST reject partition counts above 16 or partition lengths that exceed the remaining file size. The Argon2id parameters apply globally; per-partition keys are derived from the global salt combined with each partition's password.

QSDN does not provide forward secrecy across partitions: if one partition's password is compromised, only that partition's plaintext is exposed.

6. Interoperability considerations

QSDN is defined and maintained by Quantum Sequrity. The format is designed to be opaque to non-QSDN-aware tools; implementations that lack QSDN support will see a high-entropy binary file. The reference implementation rejects QSDN under --fips-mode and --regulated-mode as documented in section 1. Implementations should reject unknown major version bytes.

7. Related specifications

8. Reference implementation and contact

Reference implementation: available under commercial license. Evaluation builds: quantumsequrity.com/download. Specification queries and licensing: [email protected].