Open source self-hosted encrypted chat system

Question

I’m looking for an open source self-hosted chat system.

Here are my specs:

• it should support end-to-end encryption, preferably with AES-256 support
• it should be secure and avoid any homemade encryption protocol
• it should be user-friendly
• it should be available both for the web (and mobile), Android and preferably iOS and the phone

Answer 1

Use ChatSecure, run up your own XMPP server, OTR protocol. Downside here is that it does not meet your preferences:

1. Is not available natively through web;

2. OTR uses 128-bit long keys.

Alterntaviely you could use CryptoCat, as it meets most your needs:

1. It is open sourced

Open source. All Cryptocat software is published transparently.

2. Utilized End-To-End Encryption and supports AES

AES is used in Galois Counter Mode (GCM) for authenticated symmetric encryption with added data.

3. This topic is potentially debatable. Home made encryption (I do not believe) is used, and whether you review the code to ensure it is secure is debatable. Here is a take-out of their security page:

• AES is used in Galois Counter Mode (GCM) for authenticated symmetric encryption with added data.

• X25519 is used for all Elliptic-Curve Diffie-Hellman (ECDH)operations. A four-way ECDH handshake is used for the initial authenticated key exchange and further ECDH operations are routinely performed for preKey generation and message ratcheting.

• ED25519 is used for generating identityKeyPair and for signing and
  verifying the signedPreKey, but is otherwise unused throughout the
  protocol.

• SHA256 is used as the standard hashing function and as the underlying hash function for the HKDF.

4. As for the fact you are after this product, I assume you (and those who shall use this) are pretty tech-savvy. The application is not the most GUI friendly, but from personal experience it isn't that hard to use.

The iOS and Apple version of this product work in a similar nature. Here is a screenshot of the latest build from the website:

Here is a very basic run-down of applications you may like to consider. If you were willing to sacrifice the use of a PC chat system (You could possibly implement another application such as Wickr), I would recommend "ChatSecure".

As always, please point out incorrect facts in my answer. If you do not like CryptoCat let me know, I have others I could suggest.