SecureChat

SecureChat is the reference implementation for security layer protocols. The project demonstrates how classic cryptographic primitives combine to deliver Confidentiality, Integrity, Authenticity, and Non-Repudiation (CIANR) over a plain TCP channel.

Overview

• Console-based client/server written in Python (no TLS wrappers).
• Application-layer protocol implements hello, register/login, DH key exchange, encrypted chat, and signed session receipts.
• PKI toolchain (Root CA + issued certs) plus MySQL-backed user storage.
• Manual evidence is required for Wireshark captures, BAD_CERT/SIG_FAIL/REPLAY tests, and receipt verification.

Repository Layout

securechat-skeleton/
├── app/                 # Client, server, crypto helpers, storage, protocol models
├── scripts/             # gen_ca.py + gen_cert.py for PKI material
├── certs/               # Generated certificates/keys (gitignored, .keep ships)
├── transcripts/         # Session logs and receipts (gitignored, .keep ships)
├── tests/manual/        # Evidence checklist
├── requirements.txt     # Python dependencies
├── .env.example         # Default DB + CLIENT_CERT_CN values
└── README.md / SETUP.md # High-level overview + detailed instructions

Quick Start

1. Create a virtual environment

   python -m venv .venv
   .\.venv\Scripts\Activate.ps1
   pip install -r requirements.txt
   Copy-Item .env.example .env

2. Provision MySQL (Docker example)

   docker run -d --name securechat-db `
     -e MYSQL_ROOT_PASSWORD=rootpass `
     -e MYSQL_DATABASE=securechat `
     -e MYSQL_USER=scuser `
     -e MYSQL_PASSWORD=scpass `
     -p 3306:3306 mysql:8

3. Initialize schema

   python -m app.storage.db --init

4. Generate certificates/keys

   python scripts/gen_ca.py --name "FAST-NU Root CA"
   python scripts/gen_cert.py --cn server.local --out certs/server
   python scripts/gen_cert.py --cn client.local --out certs/client

   The server validates the CN/SAN on the client certificate. Keep CLIENT_CERT_CN (in .env) aligned with the client cert you generated.
5. Run SecureChat

   python -m app.server   # console accepts 'quit' to stop cleanly
   # in another terminal (same venv):
   python -m app.client

6. Use the client
   • r to register, l to log in.
   • Type messages to send encrypted, signed chat.
   • receipt requests a signed transcript hash; quit exits.

All steps above are described in detail (including troubleshooting and alternate DB setups) in SETUP.md.

Important Rules

• Do not wrap sockets with TLS/SSL; all crypto must remain at the application layer.
• Never commit secrets (certs/*.key, transcripts, .env, etc.).
• Follow the assignment rubric (minimum 10 meaningful commits, Wireshark evidence, tamper/replay tests).

Deliverables

1. ZIP of your GitHub fork.
2. MySQL schema dump + sample records.
3. Updated README explaining setup, usage, and test evidence.
4. RollNumber-FullName-Report-A02.docx
5. RollNumber-FullName-TestReport-A02.docx

Security Evidence Checklist

• ✅ Wireshark capture showing encrypted payloads only.
• ✅ BAD_CERT scenario (invalid/self-signed cert rejected).
• ✅ SIG_FAIL scenario (tampered ciphertext rejected).
• ✅ REPLAY scenario (reused seqno rejected).
• ✅ Non-repudiation (exported transcript + signed SessionReceipt verified offline).

Need step-by-step guidance (Docker vs. local MySQL, cert generation, troubleshooting)?
See SETUP.md for the authoritative run book.