Overview

Currently, SMS messages are sent in clear text. This means that network operators and governments can monitor communication. Billions of text messages are sent every day.

How could we encrypt text messages? The main problems are:
  1. Figuring out a way to establish cryptographic keys.
  2. Figuring out how to interface the required software to the SMS engine on popular phones.
  3. Doing all this in such a way that the difficulty of sending and receiving the messages is not increased too much.

Aims

  1. To design an architecture that gives reasonably good secrecy for text messages, having minimal impact on usability.

Project details

The project involves quite a lot of thinking, to try to find the optimal balance of security and usability, while staying within the realms of what is possible on commodity phones.

For key establishment, PKI probably won't work, since X509 certificates are not available for individuals, and PGP seems too hard for people to use. Moreover, it is not clear that phones have the computational resources (and crypto libraries) for RSA cryptography. Probably Diffie-Hellman key agreement is a better basis, with authentication done either by face-to-face communication or by the participants' ability to recognise each other's voices on the phone. Storing keys or key material in the contacts list (in the place of another number) may be useful. A symmetric encryption algorithm such as AES (or even 3DES) should work fine.

 

References