Consumer Messaging Platform — WhatsApp-Class System  ·  View 05 of 23

Registration & Device Onboarding

Phone-number sign-up end to end: verification, attestation, identity key generation, prekey publication and contact discovery.

Editable source SVG draw.io All views
User
User
Client App
Client App
Edge Gateway
Edge Gateway
Account Service
Account Service
OTP Provider
OTP Provider
Key Distribution
Key Distribution
Contact Discovery
Contact Discovery
1. enter phone number
1. enter phone number
2. register(E.164, device pubkey)
2. register(E.164, device pubkey)
3. create pending account
3. create pending account
4. rate limit by number, IP, device
4. rate limit by number, IP, device
5. send 6-digit code
5. send 6-digit code
6. SMS or voice call
6. SMS or voice call
7. enter code
7. enter code
8. verify(code, attestation)
8. verify(code, attestation)
9. check SIM-swap signals
9. check SIM-swap signals
10. account id + device token
10. account id + device token
11. generate identity key pair
11. generate identity key pair
12. publish identity, signed prekey, 100 one-time prekeys
12. publish identity, signed prekey, 100 one-time prekeys
13. registration complete
13. registration complete
14. upload hashed address book
14. upload hashed address book
15. registered contacts, privacy filtered
15. registered contacts, privacy filtered
16. re-registration lockout if number reused
16. re-registration lockout if number reused
Registration & Device Onboarding
Registration & Device Onboarding
Private keys never leave the device. Only public key material reaches Key Distribution.
Private keys never leave the device. Only public key material reaches Key Distribution.
v 1.0 · owner Platform Architecture · date 2026-08
v 1.0 · owner Platform Architecture · date 2026-08Text is not SVG - cannot display

Identity model

  • The phone number is the account identifier; the device holds the cryptographic identity
  • Registration produces a key pair on device — the server sees public material only
  • One hundred one-time prekeys are published so peers can start sessions while the device is offline

Abuse controls

  • Rate limits per number, per IP and per device fingerprint on every attempt
  • Device attestation rejects emulated and modified clients before a session opens
  • Re-registration of an existing number triggers a seven-day lockout and notifies linked devices

Contact discovery

  • The address book is uploaded as salted hashes, matched server side, then discarded
  • Privacy settings are applied before any result is returned
  • Enumeration is defeated by per-account query budgets, not by obscurity
Solution Architecture v1.0 · Platform Architecture · 2026-0805-identity-registration