Member Avatar for gunbuster363

I got this project about building a secure communication between 2 user, with the help of a server. And I was confused.
--------------------------------------------------------------------------------
The description said:

  • 2 Contributors
  • 3 Replies
  • 93 Views
  • 13 Hours Discussion Span
  • Latest Post Latest Post by vasanth19

Dani AI

Generated

Quick overview for (C# on Windows): 's point about protecting registration and transport is useful, but transport protection alone doesn't prevent the server from reading messages. The first design decision is the trust model: make the server a trusted endpoint (it can read messages) or make it a relay only (true end-to-end encryption).

For an end-to-end design, use identity keypairs per user and an authenticated ephemeral key exchange for forward secrecy. Typical building blocks: identity keys, ephemeral ECDH (X25519 or ECDiffieHellman), HKDF for key derivation, and an AEAD cipher (AES-GCM or ChaCha20-Poly1305) for encryption+integrity. Sign or authenticate ephemeral keys with the identity key so the exchange cannot be spoofed.

Practical C# implementation checklist:

  • Generate and store a long-term identity keypair on the client; protect the private key with ProtectedData.Protect or a hardware-backed store.
  • Publish only public keys/fingerprints to the server; minimize metadata stored server-side.
  • For each session/message create ephemeral keys, derive a symmetric key via HKDF, encrypt with AEAD and include associated data (sender id, version, timestamp). Use RandomNumberGenerator for nonces; never reuse a nonce.
  • For offline delivery use pre-keys so the recipient can establish a session when they come online.
  • Use vetted libraries (libsodium wrapper, BouncyCastle, or .NET System.Security.Cryptography in modern .NET) instead of implementing primitives yourself.

Common pitfalls and cautions: do not reuse nonces (breaks AES-GCM), avoid rolling your own crypto, protect private keys and logs, account for clock skew when using timestamps, and ensure TLS configuration for any transport is current. Start with a minimal E2E proof-of-concept, then add key rotation, replay protection, and hardened key storage.

Recommended Answers

All 3 Replies

Member Avatar for vasanth19

If it's a web based registration, you could accept the registration process using SSL.
Your messaging application could also use SSL to exchange the messages, if you use HTTP.

Which platform did you plan to implement ?

Member Avatar for gunbuster363

If it's a web based registration, you could accept the registration process using SSL.
Your messaging application could also use SSL to exchange the messages, if you use HTTP.

Which platform did you plan to implement ?

C#
windows

Edited by gunbuster363 because: n/a
Member Avatar for vasanth19

This could be what you are looking for ...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.