Hybrid Post-Quantum Cryptography Messenger

A secure real-time messaging application implementing hybrid cryptography that combines post-quantum and classical algorithms for defense-in-depth security.

Security Architecture

This messenger implements a hybrid cryptographic scheme combining:

• Kyber-768 (ML-KEM): NIST-standardized post-quantum key encapsulation mechanism
• X25519: Classical elliptic curve Diffie-Hellman key exchange
• ChaCha20-Poly1305: Authenticated encryption with additional data (AEAD)
• HKDF-SHA256: Key derivation function for combining shared secrets

Why Hybrid Cryptography?

The hybrid approach ensures security remains intact even if one algorithm is compromised:

• Kyber-768 protects against future quantum computer attacks
• X25519 provides proven security against classical attacks today
• Security holds if at least one algorithm remains secure

Features

• Quantum-Resistant: Protects communications against future quantum threats
• Forward Secrecy: Ephemeral keys ensure past communications remain secure
• Authenticated Encryption: ChaCha20-Poly1305 prevents message tampering
• Real-time Messaging: Asynchronous TCP-based communication using Tokio
• Zero Dependencies on External Libraries: Pure Rust implementation

Prerequisites

• Rust: 1.56.0 or higher
• Operating System: Linux, macOS, or Windows (with WSL for best compatibility)

Installing Rust

# Install Rust toolchain
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source $HOME/.cargo/env

Installation

# Clone the repository
git clone <repository-url>
cd hybrid-pqc-messenger

# Build the project
cargo build --release

Usage

The application consists of two binaries: a server and a client.

Starting the Server

Open a terminal and run:

cargo run --release --bin server

Or run the compiled binary directly:

./target/release/server

The server will:

1. Start listening on 127.0.0.1:8080
2. Wait for a client connection
3. Perform hybrid key exchange
4. Enable encrypted messaging

Starting the Client

Open a second terminal and run:

cargo run --release --bin client

Or run the compiled binary directly:

./target/release/client

The client will:

1. Connect to the server at 127.0.0.1:8080
2. Complete the hybrid key exchange
3. Enable encrypted messaging

Sending Messages

Once both server and client are running:

1. Type your message in either terminal
2. Press Enter to send
3. Messages are encrypted with ChaCha20-Poly1305 before transmission
4. Type /quit to exit

Project Structure

hybrid-pqc-messenger/
├── Cargo.toml          # Dependencies and project configuration
├── src/
│   ├── lib.rs          # Core cryptography implementation (HybridCrypto)
│   ├── server.rs       # Server binary
│   └── client.rs       # Client binary
└── README.md           # This file

Key Exchange Protocol

SERVER                                    CLIENT
  |                                         |
  |  1. Generate Kyber + X25519 keypairs   |
  |────────────────────────────────────────>|
  |     Send: kyber_pk, x25519_pk           |
  |                                         |
  |  2. Client encapsulates & responds      |
  |<────────────────────────────────────────|
  |     Recv: kyber_ct, x25519_pk           |
  |                                         |
  |  3. Both derive session key             |
  |     HKDF(x25519_shared || kyber_shared) |
  |                                         |
  |  4. Encrypted chat (ChaCha20-Poly1305)  |
  |<───────────────────────────────────────>|

Running Tests

Execute the test suite:

cargo test

This will run unit tests for key exchange and encryption/decryption operations.

Building for Release

For optimized production builds:

cargo build --release

Binaries will be located in target/release/:

• target/release/server
• target/release/client

Security Considerations

Current Implementation

This is a demonstration and learning project. The implementation includes:

• ✅ Hybrid post-quantum and classical key exchange
• ✅ Authenticated encryption
• ✅ Forward secrecy with ephemeral keys
• ✅ Constant-time cryptographic operations (via RustCrypto)

Production Hardening Required

For production deployment, implement:

• Authentication: Verify peer identity (certificates, signatures)
• Key Ratcheting: Perfect forward secrecy with periodic key rotation
• Replay Protection: Monotonic counters or timestamps
• Rate Limiting: Prevent denial-of-service attacks
• Secure Key Storage: Hardware security modules (HSM) or secure enclaves
• Error Handling: Production-grade error recovery without panics
• Logging & Monitoring: Security event logging and alerting
• TLS Layer: Additional transport layer security
• Multi-client Support: Handle multiple concurrent connections

Dependencies

Key cryptographic libraries used:

Library	Purpose	Version
pqc_kyber	Kyber-768 post-quantum KEM	0.7.1
x25519-dalek	X25519 elliptic curve DH	2.0.1
chacha20poly1305	Authenticated encryption	0.10.1
hkdf	Key derivation function	0.12.4
sha2	SHA-256 hashing	0.10.8
tokio	Async runtime	1.35
serde	Serialization	1.0
bincode	Binary encoding	1.3

Technical Details

Cryptographic Parameters

• Kyber Security Level: Level 3 (equivalent to AES-192)
• Public Key Size: 1,184 bytes (Kyber-768)
• Ciphertext Size: 1,088 bytes (Kyber-768)
• Shared Secret Size: 32 bytes (both Kyber and X25519)
• Session Key Size: 32 bytes (256 bits)
• Nonce Size: 12 bytes (96 bits)

Performance

Approximate performance on modern CPUs:

• Key Generation: ~100,000 operations/second
• Encapsulation: ~100,000 operations/second
• Decapsulation: ~100,000 operations/second
• Encryption/Decryption: >1 GB/second

Contributing

Contributions are welcome! Areas for improvement:

1. Multi-client support (broadcast messaging)
2. File transfer capabilities
3. GUI implementation
4. Mobile platform support
5. Key ratcheting for perfect forward secrecy
6. Comprehensive benchmarking suite

License

MIT License - see LICENSE file for details

References

• NIST Post-Quantum Cryptography Standardization
• Kyber Specification (CRYSTALS-KYBER)
• RFC 8439: ChaCha20 and Poly1305
• RFC 7748: Elliptic Curves for Security
• RFC 5869: HMAC-based Key Derivation Function

Acknowledgments

Built with the excellent Rust cryptography ecosystem:

• RustCrypto - Cryptographic algorithms
• dalek-cryptography - Elliptic curve cryptography
• Argyle Software - Kyber implementation

---

Disclaimer: This is a demonstration project for educational purposes. It has not undergone security auditing and should not be used to protect sensitive information in production environments without proper security review and hardening.