Encrypted LAN Chat Application with Group Rooms and File Transfer (Python)

Laboratories, hostel floors and office wings run on local-area networks, yet the messaging tools students actually use there all route through the public internet — accounts, distant servers and data plans are needed just to send a file to the PC across the room. When the campus link goes down, even that stops working. This project builds the alternative: a desktop chat application in Python where every PC on the subnet runs the same program, peers find each other automatically over UDP broadcast, group rooms carry encrypted text, and files travel as encrypted chunks over direct TCP connections. Nothing leaves the LAN. The encryption is genuine end-to-end design, not transport-only: each peer pair negotiates a session key with X25519 elliptic-curve Diffie-Hellman, and every message frame is sealed with AES-256-GCM, so a packet sniffer on the same network sees only ciphertext. A sniffer-verification test is part of the delivered test plan, so the security claim is something the student can demonstrate, not just assert.

This is a built-to-order software project: the Python application, protocol documentation, security test plan and the complete viva kit (report, PPT, Q&A) are prepared fresh for you.

The problem
A plain socket chat is one of the most common networking mini-projects, and that is exactly its weakness: it teaches TCP but teaches nothing about security, discovery or reliability. Students demo a plaintext chat where anyone on the subnet running Wireshark reads every message, peers are hard-coded by IP address, and file transfer — if it exists at all — is a single blocking send with no integrity check, so a corrupted transfer is discovered only after opening a broken file. Meanwhile the real-world alternative everyone reaches for is a cloud messenger, which needs internet, accounts and a server outside the institution. This project sits in the gap that matters: a LAN-native messenger that behaves like the tools students already know (rooms, DMs, file drops, history) while implementing the three things the toy versions skip — automatic peer discovery, real end-to-end encryption with proper key exchange, and a file-transfer engine with per-chunk checksums and resume. The result is a project with genuine systems depth: sockets, broadcast discovery, applied cryptography, threading and GUI design in one build.

1. On launch, the node binds a TCP listening port and starts broadcasting UDP presence beacons (approximately every 5 s, design target) carrying its display name, listening port and X25519 public key; every node builds its peer table from received beacons — no manual IP entry, no central server.
2. When two peers first communicate, they run an X25519 key exchange and derive a session key with HKDF; from that point every payload between them travels as an AES-256-GCM frame (nonce, ciphertext, authentication tag).
3. Joining a group room sends a join request to the room host, which returns the room session key wrapped under the joiner's pairwise key; the host then relays each member's encrypted messages to the rest of the room.
4. A typed message is encrypted on the sender's device with the room key before it touches the network; each member decrypts locally and appends it to the SQLite history, which supports keyword search.
5. Membership changes trigger automatic rekeying: a fresh room key is distributed to remaining members so a departed member cannot read new traffic (design target: rekey also every 1000 messages).
6. For files, the sender first transmits a manifest (file name, size, chunk count, whole-file SHA-256); the file is then split into 64 KB chunks (design target), each sealed with AES-GCM and sent with its own SHA-256 checksum.
7. The receiver verifies every chunk, re-requests corrupt ones automatically, shows live progress with speed, and supports pause and resume from the last verified chunk; the assembled file is accepted only if the whole-file hash matches the manifest.
8. The PyQt6 GUI keeps networking on background threads, so the chat pane, member roster and transfer manager stay responsive while transfers run.

Tech stack:

• Python 3.10+ (application, networking, threading)
• cryptography library (X25519 key exchange, AES-256-GCM, HKDF, SHA-256)
• PyQt6 (desktop GUI: room list, chat pane, transfer manager)
• Python socket module (TCP transport, UDP broadcast discovery)
• SQLite 3 (local message history)
• Custom LAN chat protocol (documented in the protocol spec)
• Wireshark (verification test for the encryption claim)
• Git (source control)

Requirements

• Two or more PCs on the same LAN subnet (wired Ethernet or Wi-Fi) for live multi-peer testing; single-PC loopback mode works for development and the demo.
• Python 3.10 or newer on each machine, plus pip-installable packages (cryptography, PyQt6) — approximately 250 MB disk space (expected).
• No internet connection, accounts, or servers are required at runtime — the application is LAN-only by design.
• Wireshark is needed only to run the optional sniffer-verification test from the test plan; it is not required to use the application.

• [End-to-end encrypted messaging] Every message is sealed with AES-256-GCM under a session key negotiated by X25519 ECDH. A sniffer on the LAN captures ciphertext only — verified by the delivered Wireshark test procedure.
• [Group rooms with rekeying] Create and join named rooms over the LAN; the room host distributes session keys and triggers automatic rekeying on membership change, so departed members lose access to new messages.
• [Automatic peer discovery] UDP broadcast beacons advertise each node (name, port, public key); the peer list populates itself in seconds on a /24 subnet with no configuration and no server.
• [Encrypted file transfer engine] Files move as 64 KB AES-GCM sealed chunks (design target), each with a SHA-256 checksum; corrupt chunks are re-requested automatically and transfers survive interruption with resume.
• [Transfer manager UI] Live progress bars with speed, per-transfer pause/cancel, and a completed list showing whole-file hash verification results for every received file.
• [Direct encrypted messages] One-to-one conversations use the pairwise session key directly, with the same AES-GCM framing as rooms and a visible per-contact security indicator.
• [Searchable local history] Chat history persists in SQLite on each PC with keyword search across rooms and contacts; nothing is uploaded anywhere.
• [Optional: passphrase lock on history] An optional add-on, quoted separately: encrypting the local SQLite database with a user passphrase for shared lab PCs. Not part of the base build.

• Complete Python source code: networking layer, security layer, file-transfer engine, PyQt6 GUI
• Documented custom LAN protocol specification (beacon format, frame format, file manifest schema)
• Security test plan including the Wireshark sniffer-verification procedure
• Setup guide (Python environment, dependency install, multi-PC test procedure)
• Project report PDF (background, protocol design, cryptography choices, test results procedure)
• PPT presentation for final review
• Viva Q&A preparation document (sockets vs WebSockets, UDP broadcast, Diffie-Hellman, AES-GCM vs CBC, threading in GUI apps, checksums vs MACs)