E2EE Message

sequenceDiagram
    participant Alice as Alice
    participant Server as Server
    participant Bob as Bob
    
 	Note over Alice, Bob: Establish a secure connection over a WSS channel
    Alice->>Server: Generate RSA key pair (A_pub, A_pri), send public key A_pub
    Server->>Bob: Broadcast Alice's public key A_pub
    Bob->>Server: Generate RSA key pair (B_pub, B_pri), send public key B_pub
    Server->>Alice: Broadcast Bob's public key B_pub
    Note over Alice, Bob: Exchange AES keys by asymmetric encryption via RSA

	Alice->>Alice: Generate Alice_AES_key
	Bob->>Bob: Generate Bob_AES_key

    Alice->>Server: Send encrypted message M_AK(Alice_AES_key, B_pub)
    Server->>Bob: Forward message M_AK
    Bob->>Bob: Decrypt to get Alice_AES_key
    
    Bob->>Server: Send encrypted message M_BK(Alice_AES_key, A_pub)
	Server->>Alice: Forward message M_BK
	Alice->>Alice: Decrypt to get Bob_AES_key
	
	Note over Alice, Bob: Exchange messages via AES encryption
	
    Alice->>Server: Send encrypted message M_A_AES(Alice_AES_key, Message_A)
    Server->>Bob: Forward M_A_AES
    Bob->>Bob: Decrypt to get Message_A
    
    Note over Alice, Bob: Try peer-to-peer communication via XTCP hole punching
    Bob->>Alice: Send encrypted message M_A_AES(Bob_AES_key, Message_B)
    Alice->>Alice: Decrypt to get Message_B

Note that, direct link is based on NAT Traversal. If failed, fall back to server-forwarded transmission.