Kisapp Blog

Kisapp, encryption is for everyone!

In our active steps to popularize encryption and the safety of personal data, making it easily understandable and accessible to all, we propose you to familiarize yourself with Kisapp through five parts: communications between your devices and our servers, the synchronization of your address book, the smart book, the encryption of your messages, and additional security measures.

Everything is transparent and invisible to you, it is the internal mechanisms of Kisapp.

Devices - Servers communications
All communications between your devices and our servers are secured using HTTPS. To ensure no compromise of past exchanges, in case of a server’s private key disclosure, the HTTPS includes the Perfect Forward Secrecy. Your information will transit encrypted through a TLS tunnel (Transport Layer Security) using ECDHE (Elliptic Curves Ephemeral Diffie-Hellman) ensuring the utmost confidentiality and integrity of your data:

TLS_ECDHE_ECDSA_WITH_AES_256 _GCM_SHA384_P521

If you 're not familiar with it,  the numbers you see represent the keys’ lengths. The greater the length is, the more difficult it is to decipher. For instance, AES 256 is more secure than AES 128.

Synchronization of your address book
So that the phone numbers of your contacts are never stored in clear on our servers, we hash them using SHA256. A hash will transform information, here a telephone number, into a string of random characters. Once hashed, it is impossible to recover the original information.

Thus, each user registered with Kisapp will have sent a hashed version of their phone number and contacts’ numbers to our servers. This way, if a new user pushes the hashes of his address book’s numbers, our servers will be able to match the contacts already registered on Kisapp without having to store these numbers… unlike the majority of available apps that store them in clear.

Concretely, here's what this process looks like:
1. The user number is: +1-333-333-3333
2. This number is hashed using SHA256 encryption
3. The number communicated to our servers is the following:
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5 c1fa7425e73043362938b9824
4. It is from this string of random characters that we find if your contacts are already listed on Kisapp

Kisapp smart address book
Unlike the iOS address book, the Kisapp address book is stored fully encrypted on our servers. To ensure the utmost privacy, part of the key used for its encryption consists of your own secret code. It is therefore very important to memorize it, because without it and in case of reinstalling the app, your smart book cannot be recovered, by anyone.

Message Encryption
When you register, your device generates a pair of RSA 2048 private / public keys.

Your public key is pushed on our server and is part of your general information, as well as the hash of your phone number. You have as many key pairs as different devices. Your private key, which is the only one able to decipher your conversations is never shared, and never transmitted over the network. It remains confined in the most protected space of your iOS devices, the keychain, where all your credit card information, digital fingerprints, and other passwords are saved. Nobody, not even Apple can access it. It is important to specify that messages are never transmitted to Apple or to any other parties.

Here's what the process looks like:
When Kevin wants to send a message to Julia :
- Kevin’s app generates a single use AES 256 key (symmetric)
- It creates a signature of the message with his private key
- It encrypts the message with the AES 256 key (symmetric)
- It encrypts the AES 256 key (symmetric) with Julia’s RSA 2048 public key

The message is permanently sealed, which means that once out of your device, it cannot be altered. Finally, Kevin’s app sends the information onto the Kisapp server. The server collects the encrypted message that can only be decrypted with the Julia’s private key:

- Julia’s app decrypts the AES 256 key (symmetric) with her RSA 2048 private key,
- It decrypts Kevin’s message using the AES 256 key (symmetric),
- It checks the message’s signature using both the decrypted message and Kevin’s public key, to ensure he is the author of the message,
- Julia can read the message before it self-destructs

After deletion of the message on Julia’s device, the server deletes all traces of it along with any associated data using a secure erase protocol (Secure File Shredding) ensuring that it cannot be forensically recovered, ever.

In summary :
All messages transiting are highly encrypted. The transport of messages between devices and servers is protected by a HTTPS layer (encrypted again and including the Perfect Forward Secrecy). The protocol allows to send messages of all types (text, photos, videos) to multiple recipients, rapidly and reliably.

Spam-Proof

With Kisapp, each message has a unique signature. This signature is generated with a portion of your private key. When the message hits our servers, we validate the signature and check if the message has not been already sent. If this is the case, the message is simply blocked, protecting you to receive the same message several times.

In addition, if a user sends you unwanted messages you can easily block it either by going in the Contacts list tab, or directly via its profile.

Man-in-the-middle Proof

When writing your message, Kisapp hashes its content and any data associated with it, and generates a signature of this hash with your private key.

Once on the servers, the hash is restored and we use your public key to verify its authenticity. This means your message is permanently sealed and no one can alter it.

This process is just as secure when the server communicates with you:
- The server generates an AES key 256
- The server encrypts this key with your public key
- The server generates the response (eg the recipient list) then encrypts it with the AES key 256

Upon receipt of the message on your device, this process is reversed and ensures that no one can alter the response of the servers.

Kisapp, Keep it Safe

The ultimate ephemeral IM app.

Even though a few apps have approached encryption and self-destruction, the proposed solutions are so far perfectible and come at the high cost of an impoverished user experience.

An ephemeral message before Kisapp was a message to which we were manually assigning a self-destruction timer. This means that before sending your message, you had an extravisual layer, which at best had the form of a slider, and that you needed to adjust according to the time frame during which you wanted your message to be displayed on your friend’s device. A process difficult to describe, so imagine in practice !

This solution has two major problems. First, it complicates and slows down the action of sending a message. Secondly, it is not suited to modern communications and the devices we own. It is impossible to accurately judge the time each of our contacts need to read a specific message. Even more considering this time also varies depending on the device used and the circumstances in which your contacts are. This had to change !

We then wondered how to create a technology capable of assigning an optimal timer according to the people, the devices used, the uses, and the actual messages received. It is in this context that we have developed the first smart ephemeral system of encrypted communications, exclusively for Kisapp. This algorithm is embedded into your app and never leaves it. It cannot read your messages and the absolute confidentiality of your messages is guaranteed.

Depending on the content of the message you receive, the in-app algorithm sets up an optimal self-destruction timer,  giving you the optimal time to read your message and digest the information.  Because we are all different and all need a different time to read a same message, you have three different deletion speeds in the settings and can choose to switch between these at anytime, simply and instantly.

Magic ? almost !

This algorithm makes an instant messaging app smart for the very first time ever. If you just reply to a question by  "OK" the reading time will be minimal and proportional to the chosen speed. Inversely, if you provide bank details or a phone number, reading time will be different... yet always optimized. And our « little extra » is that every message is animated, in a unique way, showing you its encryption and decryption.

We strongly believe that mobile communications are moving toward ephemeral. Our societies evolves, just like our concerns and needs for better security and privacy. Thanks to our global patent-pending technology, we are proud to offer you the ultimate ephemeral experience with Kisapp.

Kisapp, Keep it Simple

Simple, as your right to privacy.

We started this project over a year ago, so we are proud to announce that Kisapp is now available around the world. This is a great day for us, and a great day for the security and confidentiality of our communications.

With Kisapp, our desire is to bring you an innovative instant messaging service, offering the best possible user experience across all types of devices. Today we respond to the problems of freedom of speech and rights to privacy raised by our societies and almost all existing communication tools. With Kisapp, we aim to revolutionize SMS and other instant messaging services, starting from a simple observation that can be summarized in a few question:

• How many of your read private conversations are stored on your devices, although you never read them again?

• How many times have you sent bank details or sensitive information fearing that they’ll be kept and fall into the wrong hands?

• How many times have you given your phone fearing someone will read your messages?

Because we firmly believe that messages are not destined to be stored forever, and you should not have to worry about your information falling into the wrong hands, we created the first and only truly ephemeral and secure communication technology. Our algorithm embedded in Kisapp configures optimal timer before the self-destruction of every message you receive, allowing you to focus on what is really important : keep in touch with the people you care about.

Kisapp is the first messenger in the world to be 100% smart ephemeral, with a multi-layer encryption for all communications between users and servers. It is also the first app in the world to bring innovations and features such as instant synchronization on all your compatible devices, a dedicated Kisapp address book, an anti- screenshot system, a night mode, a BCC grouped message sending function inspired by the world of emails, a live animation of messages and many others that we invite you to discover.

We firmly believe that mobile communications must remain simple, accessible, confidential and secure. Human rights to private communication and freedom of speech are at the heart of our approach. This guides every decision, technical and political, we make as a company.

We see Kisapp as a tool of the future, a smart instant messaging app capable of, on a modest scale, improving your daily lives by using technology to give you back what was stolen from you in recent years; your freedom of speech, your privacy, and the security of data. Kisapp was conceived and designed by combining the strongest encryption to a patent-pending self-destruction technology to strengthen mobile security while making it more accessible than ever, and without you having to worry about storing your data, their monetization, and advertising.

Think a minute about all these companies employing people, that have expenses, but still offer you to use their products for free. Do you really think that these products are "free" ? You are the product and use their services at the cost of your own privacy. We think this must change !

The minimal information - necessary to the good functioning of Kisapp - we collect is indecipherable, and we will never monetize it. This is why Kisapp will charge a symbolic amount of money after its free for life exclusive promotion to celebrate our launch. This will allow us to get on and improve our app, without having to think about anything else other than providing you with the best without any compromise.

And with government information systems and companies’ networks that have faced large-scale and critical violations in recent years and months, we also think about building an alternative version dedicated to businesses and working on a subscription basis. The principle remains the same, same technology, same level of confidentiality and security for all.

Nothing else is more important for us that the respect of your privacy and the security of your data. It is at the heart of our approach, and we have developed Kisapp with the will not to know anything about you: We do not know who you are, who you communicate with, what you say or where you are. We do not know your home address, we do not know where you work, we do not know what you like or what you search online. We do not analyze the multimedia content you share, we do not look at your photos. We do not know and we do not want to know. This is the essence of Kisapp. None of these data will never be stored in clear or encrypted after being destroyed. Your communications are protected by our algorithm of self-destruction and a stack of end-to-end encryption using the strongest keys available for use. Once a message is destroyed, its deletion is immediately synchronized between all your devices and our technology ensures it cannot be forensically recovered. We do not analyze your communications and have no way to decrypt your data. The only key able to decrypt your messages, your private key, is housed in a secure area of your device that no one can gain access to.

We are committed to a total transparency with our users, and will regularly publish reports on official requests made to us, if any.

I wish to reiterate here that Kisapp is the materialization of our vision and our unwavering commitment to building the first smart secured messaging app for people and businesses around the world. It is an honor for us to see the satisfaction of our users, trusting us to secure their communications, personal data, and to protect their right to privacy and we take that responsibility very seriously.

On behalf of the entire team that was able to bring this project to life, we thank you for your confidence, your enthusiasm and the positive feedback.

Truly,

Kevin