🎨 Why "KaleidoTalk"?
KaleidoTalk = Kaleidoscope + Talk — because every conversation should be as unique and ephemeral as a kaleidoscope pattern. Built for privacy, designed for trust.
Deep dive into KaleidoTalk's cryptographic design — X25519 automatic key rotation (24‑hour cycle), irreversible Ed25519 account freeze, cover traffic with fixed‑length packets and randomized heartbeats, plus full protocol specification and security analysis.
⬇ Download / Read PDFKaleidoTalk = Kaleidoscope + Talk — because every conversation should be as unique and ephemeral as a kaleidoscope pattern. Built for privacy, designed for trust.
Your exchange keys are automatically rotated every 24 hours. Even if a private key is compromised, only messages from that narrow window are exposed — not your entire chat history.
✅ Forward secrecy extended · Leak impact reduced from "forever" to "hours"
Generate a recovery certificate during registration. If your account is stolen, you can permanently freeze it — no one, not even the server admin, can unfreeze it.
✅ No backdoor · Your account dies, but never falls into wrong hands
Ed25519 identity + X25519 ECDH + AES‑256‑GCM. The server stores only ciphertext — it never sees your messages.
All packets are fixed to 2048 bytes with random padding. Heartbeats at random intervals (3.3–6.7s) defeat timing analysis.
Self‑signed certificates verified by BIP39 words on first connection. No CA dependency — you control trust.
Store private keys on the server (encrypted) for multi‑device use, or keep them local-only — your choice.
Public key fingerprints shown as 6 BIP39 words. Verify them via phone or in‑person — no complicated hashes.
Messages are cached on the server and delivered automatically when your friend comes online.
Control registration with invite codes. Ban IPs or users. Rate‑limiting protects against DoS.
Modern CustomTkinter interface with system tray, dark theme, and unread badges.
| Component | Algorithm | Purpose |
|---|---|---|
| Identity | Ed25519 | Signature & authentication |
| Key Exchange | X25519 (ECDH) | Shared secret negotiation |
| Symmetric | AES‑256‑GCM | Encryption + integrity |
| KDF | HKDF‑SHA256 | Derive AES key & nonce |
| Password Storage | PBKDF2‑SHA256 (600k) | Server‑side hash, brute‑force resistant |
| Transport | TLS 1.2+ (RSA 2048) | Client‑server channel (self‑signed + TOFU) |
Message flow: Ephemeral X25519 → ECDH → HKDF → AES‑256‑GCM → Ed25519 signature → verify → decrypt.
💡 This is the kaleidoscope effect: every message uses a fresh key, so the ciphertext pattern never repeats.
cryptography · pystray · Pillow · customtkinterpip install cryptography pystray Pillow customtkinterpython run_server.pyOn first run, set an admin password to protect server keys (generated in server_keys/).
python run_client.pyDefault server: 127.0.0.1:5555. Register, then log in and start encrypted chats.
# Generate invite codes
python admin.py invites add --count 5 --uses 1 --length 8
# Require invite codes for registration
python admin.py invites set-require true
# Ban IP / user
python admin.py ban ip 192.168.1.10 --duration 3600
python admin.py ban user alice
python admin.py list-bansTLS certificate fingerprint verified via BIP39 words on first connection. Ed25519 public key delivered over TLS — no additional out‑of‑band check needed.
Compare 6 BIP39 words with your friend via phone or in‑person. Once verified, messages are automatically decrypted.
Local trust database is HMAC‑SHA256 protected against tampering.
KaleidoTalk is free software under the GNU General Public License v3.0.
KaleidoTalk Copyright (C) 2026 Bangze Han
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
📚 Third‑party libraries: cryptography (Apache 2.0), pystray (LGPLv3), Pillow (HPND), customtkinter (MIT)
Issues, PRs, and ⭐ stars are welcome. The project is stable and tested on Python 3.10+.