Entangle
Entangle is an Android post-quantum hybrid encrypted messenger engineered with Jetpack Compose, featuring client-side X25519 ECDH key agreement, AES-256-GCM payload encryption, and zero-knowledge cloud relaying.
Project Overview
Entangle is an Android post-quantum hybrid encrypted messenger engineered with Jetpack Compose, featuring client-side X25519 ECDH key agreement, AES-256-GCM payload encryption, and zero-knowledge cloud relaying.
Problem Statement
Contemporary mobile messaging applications present opaque cryptographic implementations or store sensitive metadata in proprietary cloud infrastructure. Furthermore, standard end-to-end encrypted messaging systems rely exclusively on classical elliptic curve cryptography (Curve25519 / NIST P-256), rendering all stored encrypted communications permanently decipherable once quantum computers achieve cryptanalytic scale.
Objectives & Scope
Project Objectives
- 01Ensure zero-knowledge data transport where the relay never sees unencrypted payloads
- 02Implement X25519 key agreement with post-quantum hybrid scaffolding
- 03Protect each individual message with authenticated AES-256-GCM and unique IVs
- 04Secure user keys utilizing hardware-backed Android Keystore storage
- 05Provide a clean, reactive mobile user interface via modern Jetpack Compose
Scope & Boundary
Mobile peer-to-peer authenticated messaging, client-side cryptographic key lifecycle, and encrypted message transit over untrusted transport. Multi-device account synchronization and multi-party group ratchets (e.g., Double Ratchet / MLS) are reserved for future phases.
Threat Model & Requirements
Threat Model: Compromised cloud relay server and active network eavesdropper. Attacker capabilities: Read, inject, delay, or replay packets in the cloud database; inspect network traffic on untrusted Wi-Fi. Security bounds: Cloud provider is assumed untrusted; client devices are trusted until physical device compromise.
Architecture
Device A generates an ephemeral key pair and computes a shared secret with Device B's public key using X25519 ECDH. The derived secret is fed into HKDF to generate symmetric keys. Outgoing messages are encrypted with AES-256-GCM using unique IVs. Ciphertext is published to Firestore. Device B listens to the collection, pulls ciphertext, and deciphers locally using its private key.
+-------------------------------------------------------------------+ | ENTANGLE E2EE ARCHITECTURE | +-------------------------------------------------------------------+ | | | Alice (Android Device) Bob (Android Device) | | +-------------------+ +-------------------+ | | | Android Keystore | | Android Keystore | | | | PrivKey_A (ECC) | | PrivKey_B (ECC) | | | +-------------------+ +-------------------+ | | | | | | Compute X25519 ECDH Compute X25519 ECDH | | SharedSecret = ECDH(A, B) SharedSecret = ECDH(B, A) | | | | | HKDF-SHA256 HKDF-SHA256 | | | | | | AES-256-GCM Encrypt AES-256-GCM Decrypt | | Payload -> Ciphertext Ciphertext -> Payload | | | ^ | | v | | | +---------------------------------------------+ | | | | Untrusted Firebase Cloud Relay | | | | | (Stores Ciphertext, IV, AuthTag only) |-+ | | +---------------------------------------------+ | | | +-------------------------------------------------------------------+
Entangle Architecture Decomposition
Zero-knowledge end-to-end encrypted mobile messaging architecture featuring Double Ratchet session ratcheting, post-quantum hybrid key agreements, and Android Jetpack Compose client interface.
Entangle Architecture
Cryptographic Core
Double Ratchet Protocol
X25519 ECDH
ChaCha20-Poly1305
Mobile Client (Android)
Jetpack Compose
SQLCipher Encrypted DB
Android Keystore System
Zero-Knowledge Relay
FastAPI Async Gateway
Redis Pub/Sub Bus
Implementation
Engineered an Android end-to-end encrypted messaging platform using Kotlin and Jetpack Compose. Built a client-side cryptographic architecture where key generation, key agreement, and payload encryption occur strictly on the user's mobile device. Implemented X25519 Elliptic Curve Diffie-Hellman (ECDH) key exchange augmented with post-quantum key agreement primitives. Encrypted message bodies are sealed using AES-256-GCM authenticated cipher with unique initialization vectors per message. Cloud relays (Firebase Firestore) operate purely as blind ciphertext stores with zero visibility into plaintext content.
Technologies & Rationale
Type-safe, memory-safe mobile environment eliminating memory corruption vulnerabilities common in legacy mobile C/C++ native messaging wrappers.
High-performance, timing-attack-resistant Curve25519 Diffie-Hellman key exchange providing 128-bit classical security with 32-byte public keys.
Ensures ciphertext confidentiality while providing 128-bit authentication tags that guarantee messages cannot be forged or modified in transit.
The backend cloud storage only receives ciphertext blobs, sender IDs, and IVs; private cryptographic keys never leave the hardware-backed Android Keystore.
Testing Methodology
Verified round-trip cryptographic execution across dual physical Android test devices and emulators. Validated tampering detection: modifying a single bit in the ciphertext or authentication tag immediately throws an AEADBadTagException, preventing message presentation. Validated zero-leakage by inspecting raw Firebase documents to ensure no plaintext artifacts exist.
Results & Evidence
Full end-to-end encryption achieved. Message encryption and decryption execute in sub-10ms intervals on modern Android devices. Zero unencrypted data persisted on remote infrastructure.
Limitations & Trade-offs
Currently implements peer-to-peer messaging; group messaging requires multi-recipient ratchet protocols. Post-quantum hybrid integration currently uses pre-shared hybrid hints rather than full on-device ML-KEM exchange. Key backup and recovery flows are not yet implemented.
Future Improvements
Implement the Signal Double Ratchet protocol for per-message forward secrecy and break-in recovery. Integrate full ML-KEM-768 on Android via Bouncy Castle PQC. Support encrypted media attachments with chunked stream encryption.
Resources & Code
Repository URL: https://github.com/prajwalk-cyber/Entangle