Secure Social Networking: Building a Zero-Trust Chat System from Scratch

TL;DR

This research addresses the fundamental privacy flaws in modern Online Social Networks (OSNs) by introducing an end-to-end (E2E) encrypted chat system. By leveraging RSA-2048, AES-GCM-256, and ECDSA, the authors ensure that even if a server is fully compromised, the attacker cannot read private messages or steal cryptographic keys.

The Core Dilemma: Privacy vs. Convenience

Most social media platforms operate on a business model that exploits user data. Even when they claim to be secure, the service provider usually holds the "master keys" to your data. Furthermore, governmental pressures often lead to censorship or silent data harvesting.

The authors identify a critical gap: existing secure tools are either too complex for the average user or rely on questionable third-party libraries. Their mission was to build a transparent, high-performance E2E system using only native web technologies.

Methodology: A Multi-Layered Defense

The proposed system treats the server as a hostile environment. It manages security through three distinct layers:

1. The Encrypted "Personal Storage"

When a user registers, they don't just create a password. They generate a local Storage container.

• Authentication: A key ($p_a$) is derived from the password via PBKDF2 to authenticate with the server.
• Encryption: A separate key ($p_s$) is derived to encrypt the user's private keys (RSA and ECDSA).
• Mobility: This encrypted storage is kept on the server, allowing users to move between devices without manual key migration.

2. Hybrid Chatroom Encryption

To handle group chats efficiently, the system uses Symmetric-Key Wrapping.

• For every chatroom, a unique AES key ($k_c$) is generated.
• This key is encrypted ($RS{A}_{encrypt}$) for each participant using their public keys.
• When someone joins or leaves, a new $k_c$ is generated and redistributed, ensuring forward and backward secrecy.

Figure 1: Conceptual flow of symmetric key distribution among chat participants.

3. Integrity via DAGs

To prevent a server administrator from silently deleting messages or reordering them, each message includes a reference to previous unconfirmed messages. This creates a Directed Acyclic Graph (DAG). If a message is missing, the hash chain breaks, triggering a warning to the user.

Performance and Results

The implementation utilizes the Web Cryptography API, which runs natively in the browser. Experimental results show that the overhead is negligible:

The time complexity for rotating keys in large groups grows linearly, but remains well within the threshold of human perception for an asynchronous chat app.

Table 1: The cryptographic primitives selected for maximum security and performance.

Critical Insight: The "Password Recovery" Bottleneck

As a Senior Editor, I find the authors' honesty regarding Password Loss refreshing. In a truly E2E system, if a user forgets their password, their $p_s$ key used to decrypt the "Storage" is gone forever. This is the "Gold Standard" of security, but a nightmare for UX. The paper suggests secret sharing as a potential future path, but highlights the inherent trade-off: true privacy requires total user responsibility.

Conclusion

This work serves as a blueprint for developers looking to integrate high-level security into web applications without the baggage of monolithic frameworks. By combining the the physical intuition of "locked boxes" (encryption) with the logical "chain of evidence" (DAGs), the authors have created a system where users regain sovereignty over their digital conversations.

Key Takeaways for Researchers:

• Native is better: Relying on Web Crypto API reduces the library-based attack surface.
• Hybrid is faster: Symmetric keys for content and Asymmetric keys for distribution is the SOTA for group performance.
• Integrity is as important as Secrecy: Encryption protects what you say; signature chains protect that you said it.