PQ Messenger Lite: Post-Quantum Secure Messaging

A privacy focused messenger exploring peer-to-peer communication and post-quantum security for safer messaging in the quantum era.

Comment

Inspiration Today’s messaging systems are convenient, but privacy and long-term security remain important challenges. The development of quantum computing also creates a future risk for traditional public-key cryptography.

This inspired us to build PQ Messenger Lite, a lightweight messaging prototype that explores peer-based identity, real-time communication, and post-quantum cryptography concepts. Our goal was to understand how future-resistant security ideas could be integrated into a practical messaging experience without making the application unnecessarily complex.

What it does PQ Messenger Lite is a privacy-focused messaging MVP that demonstrates:

Peer ID-based user identity.

Real-time messaging through Socket.IO.

Online peer discovery through a backend connection map.

Profile sharing between connected users.

File-sharing workflow.

Post-quantum cryptography research using ML-KEM and ML-DSA concepts.

A simple interface for creating profiles, finding peers, and starting conversations.

The project is designed as a foundation for future secure communication systems. It is currently an experimental prototype and has not undergone an independent security audit.

How we built it We built the frontend using React, Vite, TypeScript, and Tailwind CSS. The backend uses Node.js, Express, and Socket.IO to provide real-time communication between connected clients.

The application uses a peer ID model instead of relying only on traditional usernames. When a user connects, the client registers its public profile and peer ID with the backend. The backend maintains the current online peer map and synchronizes available users with connected clients.

The frontend uses environment-based configuration so local development can connect to a local backend while the production deployment connects to the Render backend. The frontend is deployed on Netlify and the backend is deployed on Render.

AI-assisted development tools were used for debugging, code refinement, and documentation. The final architecture, integration, testing, and implementation were reviewed and validated by the participant.

The architecture includes:

text React/Vite Frontend ↓ Socket.IO Client ↓ Node.js/Express Backend ↓ Peer Registration and Real-Time Message Routing We also added connection diagnostics, health checks, secure production URLs, CORS configuration, and deployment-specific environment variables.

Challenges we ran into One of the biggest challenges was understanding the difference between local browser state and actual network state. Initially, peer profiles were discovered through localStorage. This worked across two tabs in the same browser but failed across different physical devices because each device had its own storage.

We solved this by moving online peer discovery to the backend connection layer. Connected clients register their peer IDs and public profiles with the server, and the server synchronizes the online peer list.

Other challenges included:

Debugging Socket.IO connections between Netlify and Render.

Configuring production CORS for different frontend and backend domains.

Ensuring the backend listens on Render’s assigned port and 0.0.0.0.

Separating local and production Vite environment variables.

Removing an incorrect default /vite.svg reference.

Handling connection, reconnection, and disconnection states.

Keeping the MVP focused without adding unnecessary complexity.

Explaining post-quantum cryptography concepts in a usable application.

Accomplishments that we're proud of We are proud that we created a working end-to-end messaging prototype with a modern web stack and a future-oriented security focus.

Our main accomplishments include:

Built a complete React and TypeScript messaging interface.

Implemented a Node.js and Socket.IO real-time communication layer.

Added peer ID-based identity and online peer registration.

Created a backend-driven peer discovery workflow.

Connected a Netlify frontend to a Render backend.

Added local and production environment configurations.

Added health checks and connection diagnostics.

Explored ML-KEM and ML-DSA post-quantum cryptography concepts.

Built a foundation that can be extended into a more advanced secure messenger.

Most importantly, we learned how a seemingly simple localStorage-based prototype must evolve when it needs to support real users across separate devices and networks.

What we learned We learned that real-time application development involves much more than building a user interface. The frontend, backend, deployment platform, transport layer, environment variables, CORS policy, and application state must all work together.

We learned that:

Browser localStorage is not a cross-device synchronization mechanism.

Socket connection success and application-level user registration are separate steps.

Production deployments must use environment-specific configuration.

Netlify and Render require explicit frontend-backend integration.

Socket.IO reconnection and disconnect states must be handled deliberately.

Backend state stored only in memory is suitable for an MVP but not for a large production system.

Security claims must be precise, especially when cryptographic code has not been independently audited.

Post-quantum security should be designed into the architecture rather than added as a last-minute feature.

What's next for PQ Messenger Lite: Post-Quantum Secure Messaging Our next steps are focused on improving reliability, usability, and security:

Complete and validate cross-device peer discovery.

Replace temporary in-memory peer storage with a persistent and scalable data layer.

Improve reconnect and connection-state recovery.

Add stronger peer authentication and identity verification.

Complete the post-quantum cryptography integration.

Test ML-KEM key exchange and ML-DSA signatures more thoroughly.

Add secure key lifecycle and device management.

Improve file-sharing reliability for larger files.

Add automated frontend and backend tests.

Conduct an independent security review before production use.

Expand the platform for enterprise, defense, and privacy-sensitive collaboration use cases.

PQ Messenger Lite is currently an MVP research prototype. Its cryptographic components are experimental and should not yet be treated as independently audited production security. Socket.IO itself does not permanently store missed events by default, so persistent synchronization and recovery are important future improvements.

Built With

Share this project:

Updates