Secure Messenger

Secure Messenger is a secure desktop messaging application that uses end-to-end encryption to protect user communications. The application offers two encryption methods: a standard one based on AES+RSA and a custom high-security cipher named Prometheus V2.

Key Features

• Secure User Registration: Each user generates a 4096-bit RSA key pair upon registration. The private key is encrypted with a user-chosen password.
• End-to-End Encryption: Messages are never stored in plaintext. They are encrypted on the sender's client and decrypted only on the recipient's client.
• Digital Signatures: Every message is digitally signed with the sender's private key. This guarantees:
  • Authenticity: The recipient can be certain of the sender's identity.
  • Integrity: The message has not been altered during transmission.
• Dual Encryption Modes:
  1. Standard (AES+RSA): A robust and widely-tested hybrid approach.
  2. Prometheus V2: A custom multi-layer cipher that combines transposition and an evolving substitution for advanced security. It uses a KDF (PBKDF2), nonces, and a MAC for message authentication.
• Modern GUI: Built with PyQt6 and styled with a dark theme for a better user experience.

---

Installation

To run Secure Messenger on your computer, follow these steps.

Prerequisites

• Python 3.9 or a later version.
• pip (Python's package manager, usually included with a Python installation).

Installation Steps

1. Clone the Repository Clone this repository to your local machine using Git:

   git clone https://github.com/HexFud/Password-safe
   cd Password-safe

2. Create a Virtual Environment It is a best practice to isolate the project's dependencies.

   python -m venv venv

3. Activate the Virtual Environment

   • On Windows:

     .\venv\Scripts\activate

   • On macOS/Linux:

     source venv/bin/activate

4. Install Dependencies Install all required libraries using the requirements.txt file:

   pip install -r requirements.txt

---

How to Run the Application

Once the installation is complete, start the application by running the main.py file from the project's root directory:

python main.py

The application's login window will open.

---

How It Works

1. Registration and Login

• Registration: A new user chooses a username and a password. The application generates an RSA key pair. The private key is encrypted with the user's password and saved locally in the users/<username>/ directory. The public key is saved in the public_keys/ directory.
• Login: The user enters their username and password. The application attempts to decrypt the private key with the provided password. If the operation is successful, the user is authenticated.

2. Sending a Message

When a user composes a message, they can choose between two encryption methods:

Standard Method (AES+RSA)

1. A secure, random AES-256 session key is generated.
2. The message is encrypted with this AES session key.
3. The AES session key is then encrypted with the recipient's public RSA key.
4. The message is signed with the sender's private RSA key.
5. The final package (encrypted message, encrypted session key, signature, and IV) is sent to the recipient.

Prometheus V2 Method

1. The user provides two shared secrets: a Permutation Password and a Book Key-Text.
2. The message (as bytes) is first passed through a transposition layer that shuffles its bytes based on a seed derived from the Password.
3. It is then passed through an evolving Vigenère substitution layer, where each byte is replaced using a non-repeating keystream and an alphabet that changes at every step.
4. The entire encrypted package (which includes a random salt and nonce) is protected by an HMAC-SHA256 to ensure its integrity and authenticity.
5. The message is signed with the sender's private RSA key.
6. The final package (encrypted Prometheus package and signature) is sent to the recipient.

3. Receiving and Decrypting

1. When a message is selected, the application first checks the digital signature using the sender's public key. If the signature is invalid, the user is warned that the message may have been tampered with or did not come from the declared sender.
2. If the signature is valid, it proceeds with decryption:
   • Standard: The recipient's private key is used to decrypt the AES session key. This key is then used to decrypt the message.
   • Prometheus: The user is prompted for the Permutation Password and the Book Key-Text. If provided correctly, the HMAC is verified. If the verification is successful, the encryption process is reversed to recover the original message.

Project Structure

secure_messenger/
├── prometeo/       # Custom Prometheus V2 cipher package
├── ui/             # Modules for the user interface (screens and dialogs)
├── utils/          # Utility classes (e.g., Worker for threading)
├── app.py          # Main window logic (MainWindow)
├── backend.py      # Business logic (cryptography, file management)
├── config.py       # Project constants and configuration
├── theme.py        # Stylesheet (QSS) for the dark theme
├── main.py         # Application's entry point
└── requirements.txt  # Project's Python dependencies

License

This project is released under a proprietary license. Reproduction, modification, and distribution are not permitted without prior written permission.

---

*Copyright (c) 2025 HexFud