Design and Implementation of a Secure Mobile Messaging Application Based on a Hybrid ECC/AES Cryptosystem

Abstract

This thesis presents the design, implementation, and evaluation of Payn, a secure mobile messaging application that provides end-to-end encrypted communication through a hybrid ECC–AES cryptographic framework. The proposed system combines Curve25519 (X25519) for secure key exchange with AES-256-GCM for authenticated message encryption and incorporates a lightweight ratcheting mechanism to achieve forward secrecy and post-compromise security. The application was developed as a native Android platform using Kotlin and Jetpack Compose and is supported by a server-assisted Node.js backend operating under limited trust assumptions. The proposed architecture aims to provide strong security guarantees while maintaining efficient performance on resource-constrained mobile devices. Comprehensive security testing, performance evaluation, and comparative analysis against widely deployed secure messaging applications such as Signal and WhatsApp demonstrate the effectiveness of the proposed solution. Experimental results indicate that Payn successfully achieves confidentiality, integrity, and secure key management while preserving acceptable computational and communication overhead for real-world mobile environments