Developing a secure messaging application that eliminates authentication ceremony by using blockchain

End-to-end encryption is a security feature that is often based on public key cryp- tography and is used in many secure messaging applications. Thus, the transmitted messages are transmitted as encrypted with a shared key generated by the contribution of the parties. In an application with this feature, a user's public key may be changed for reasons such as device or SIM card change and reinstallation of the application, or may also be different due to a possible attack. Therefore, the new public key needs to be verified to prevent possible attacks and to ensure that communication is secure. For this purpose, many secure messaging applications have a mechanism called "authen- tication ceremony" in the case of public key changes, where public key verification is performed by users by comparing the keys from a different channel. However, it does not seem to be a good idea to expect all users to complete the authentication ceremony correctly. Therefore, in this thesis, an open source secure messaging application based on Signal Android Messenger called "BlockSignal" was developed using Blockstack platform, a blockchain based public key infrastructure (PKI) system. Thus, the authen- tication ceremony in Signal application was eliminated by the blockchain and the users were taken out of the security loop. In addition to this, a threat model was formed on the Signal application, combining the possible threats which exist in the literature apart from the authentication ceremony problem, and the security analysis of the BlockSig- nal application was shown to be able to show that it can eliminate the threats that may be encountered in Signal.