Aegis is a web-based secure group chat application built for CSC 6350 project. It provides secure messaging platform that uses post-quantum cryptography to secure messages.
Live site: https://aegis-f5e17.web.app
Note: Message sending and encryption only work when running locally. The live site currently cannot reach the encryption backend because the AWS Elastic Beanstalk endpoint is HTTP-only and browsers block HTTP requests from HTTPS pages. This will be resolved once the Firebase project is upgraded to higher plan or the backend is configured with HTTPS.
Running locally is required to use message encryption. The encryption backend is already deployed on AWS Elastic Beanstalk — you only need to run the frontend.
Prerequisites: Docker installed
git clone <repo-url>
cd aegis
docker build -t aegis .
docker run --name aegis -p 3000:80 aegis
Open your browser and go to http://localhost:3000
Prerequisites: Node.js installed
git clone <repo-url>
cd aegis
npx serve frontend -l 3000
Open your browser and go to http://localhost:3000
The encryption backend is already deployed at http://aegis.us-east-2.elasticbeanstalk.com. When running locally over HTTP, the browser allows calls to this endpoint and full encryption works end-to-end.
- Group chat with channels, roles (Admin / Moderator / Member), and invite codes
- Direct messages with online/offline presence
- Post-quantum encryption — ML-KEM-1024 key exchange, ML-DSA-87 message signing
- AES-256-GCM encryption for all messages and file uploads
- File sharing with end-to-end encryption (up to 500KB)
- Role-based access control — admins can hide channels, hide messages, manage members
- Audit log — all admin actions are logged per group
- Join requests — users can request to join a group; admin approves or denies
- Message requests — DM requests must be accepted before a conversation opens
- Username login — register and log in with a username or email
- Nicknames — set a custom display name per group
- Delete account / Leave group
| Layer | Technology |
|---|---|
| Frontend | HTML, CSS, JavaScript |
| Auth & Database | Firebase Auth + Firestore |
| File Storage | Firebase Storage |
| Encryption Backend | Java (HttpApiServer) on AWS Elastic Beanstalk |
| Hosting | Firebase Hosting |
| Post-Quantum Crypto | BouncyCastle (ML-KEM-1024, ML-DSA-87) |
| Symmetric Encryption | AES-256-GCM |
Every message and file is encrypted using all three algorithms before being stored:
Sending a message:
- Frontend sends plaintext to the Java encryption backend on AWS (
/encrypt) - ML-KEM-1024 — backend generates a fresh session key via key encapsulation
- AES-256-GCM — plaintext is encrypted with the session key (random 12-byte nonce)
- ML-DSA-87 — backend signs the ciphertext to prevent tampering
- Frontend receives
{ ciphertext, encapsulation, signature }and stores all three in Firestore — plaintext never touches the database
Receiving a message:
- Frontend reads
{ ciphertext, encapsulation, signature }from Firestore - Sends all three to backend (
/decrypt) - ML-DSA-87 — backend verifies the signature; rejects if invalid
- ML-KEM-1024 — backend decapsulates to recover the session key
- AES-256-GCM — backend decrypts and returns plaintext to the browser
AI assistance was used for the file encryption feature. Encrypting files in the browser and storing them securely was a challenging problem, and we received AI help in working through that implementation.
- Jinho Moon
- Brian Johnson
- Avyuktkrishna Ramasamy