How Qlip's Sync Works: P2P LAN Discovery, E2EE, and Relay Architecture

Synchronizing clipboard state across heterogeneous operating systems (macOS, Windows, iOS, Android) presents a fascinating set of distributed systems and security challenges.

A modern clipboard tool must deliver sub-100ms latency, survive unpredictable NAT transitions, handle mobile background execution limits, and guarantee zero-knowledge privacy for sensitive text, API secrets, and media payloads.

In this technical breakdown, we explain how Qlip’s dual-engine networking architecture works under the hood.

---

Architecture Overview

Qlip operates on a hybrid topology: local direct peer-to-peer over LAN when devices share a network, seamlessly backed by an encrypted packet relay mesh when devices operate on separate networks (e.g., Mac on home Wi-Fi and iPhone on 5G cellular).

   +-------------------+                     +-------------------+
   |   MacBook Pro     |                     |  Windows Desktop  |
   | (Device A - Local)|                     | (Device B - Local)|
   +---------+---------+                     +---------+---------+
             |                                         |
             |       mDNS / UDP Local Discovery        |
             +-----------------------------------------+
             |        Direct Encrypted TCP Socket      |
             |           (Latency: < 15ms)             |
             v                                         v
   +-------------------------------------------------------------+
   |                  End-to-End Encryption Layer               |
   |         ChaCha20-Poly1305 (Symmetric Packet Key)           |
   |           Curve25519 (ECDH Device Key Exchange)             |
   +-------------------------------------------------------------+
                                 |
              (If LAN network unreachable / Roaming)
                                 v
                     +-----------------------+
                     |  Qlip Global Relay    |
                     | (Encrypted Envelope)  |
                     |  (Latency: 45 - 80ms) |
                     +-----------------------+

---

1. Device Pairing & Zero-Knowledge Key Exchange

Before any device can exchange clipboard payloads, devices must establish mutual trust through cryptographic pairing.

1. Ephemeral Ephemeral Diffie-Hellman (ECDH): During 1-click pairing, Device A and Device B generate temporary Curve25519 keypairs.
2. Short Authentication String (SAS): A 6-digit numeric PIN is generated from the hash of the combined public keys (H(Pub_A || Pub_B)). The user confirms this PIN visually on both screens to prevent Man-in-the-Middle (MITM) attacks on untrusted Wi-Fi networks.
3. Long-Term Secret Derivation: Once confirmed, devices derive a 256-bit shared master key (K_master) using HKDF-SHA256.
4. Local Key Storage: Long-term identity keys and pairing tokens are stored inside system-native secure enclaves (macOS Keychain, Windows Credential Manager, iOS Keychain, and Android KeyStore).

---

2. LAN Discovery: mDNS & UDP Beaconing

When Qlip initializes on desktop or mobile, it starts a background local network probe engine:

Multicast DNS (mDNS)

Qlip advertises an encrypted service record (_qlip._tcp.local) containing a hashed public device identifier (DeviceHash). Other paired devices listening on the local subnet parse this record and resolve the local IPv4/IPv6 address and port.

UDP Direct Beacons

For local networks that suppress multicast DNS broadcasts (common in corporate Wi-Fi or guest networks), Qlip sends lightweight encrypted UDP ping beacons across subnet broadcast addresses (255.255.255.255:49152).

Once a paired peer is identified:

• A persistent TCP connection is established over TLS 1.3 with mutual certificate verification.
• Payloads bypass cloud servers entirely, streaming directly over local sockets at LAN line rates (typically 8 to 15 milliseconds).

---

3. Payload Encryption Pipeline

Every clipboard copy event triggers a streaming pipeline before transmission:

// Conceptual packet construction pipeline
interface QlipPacket {
  version: number;
  senderId: string; // Hashed UUID
  nonce: string;    // 96-bit unique cryptographically secure nonce
  ciphertext: string; // Base64 encoded ChaCha20-Poly1305 payload
  tag: string;      // 128-bit authentication tag
}

1. Payload Serialization: The copied item (plain text, HTML code, image buffer, or file metadata) is serialized into binary Protobuf format.
2. Nonce Generation: A unique 96-bit random nonce is generated for every packet to prevent replay attacks.
3. AEAD Encryption: The payload is encrypted using ChaCha20-Poly1305.
4. Transmission: The encrypted ciphertext packet envelope is dispatched over the active LAN socket or relay transport channel.

Because the key K_master is known only to your paired devices, relay servers see only random binary blobs.

---

4. Encrypted Relay Fallback

When devices move across networks (such as leaving your office or switching to cellular), local direct LAN sockets fail gracefully.

Instead of stalling or running complex WebRTC ICE candidate gathering (which can take 2–5 seconds during network handoffs), Qlip switches to Relay-as-Floor Mode:

• Each client maintains a lightweight WebSocket connection to the nearest geographical Qlip relay cluster.
• When Device A copies text while remote, it publishes the encrypted envelope to the relay server.
• The relay routes the envelope directly to Device B’s active connection channel in < 60ms.
• Relay servers immediately discard packets upon delivery and retain zero state.

---

Summary Performance Benchmarks

Metric	LAN Direct Socket	Encrypted Relay Fallback
Discovery Latency	50 – 120ms (mDNS)	Instant (Persistent Socket)
Transfer Latency	8 – 18ms	45 – 85ms
Encryption Standard	Curve25519 + ChaCha20	Curve25519 + ChaCha20
Network Bounds	Same Wi-Fi / Subnet	Global Internet / 5G / LTE
Cloud State	Zero Cloud	Zero Cloud (Ephemeral Routing)

Qlip’s networking engine delivers the speed of local hardware with the reliability of cloud infrastructure — without sacrificing zero-knowledge security.