ABSTRACT
Short Message Service (SMS) is one of the most used mobile data services. It is utilized in wide range of applications including information delivery, remote operation of appliances, online purchases/banking transactions. However, some of these applications require that the underlying messaging protocol must guarantee secure communication; which traditional SMS cannot provide. State of the art approach to adding security to SMS messaging involves the use of asymmetric cryptography, supported by Public Key Infrastructure (PKI) for addressing public key verification/validation issues inherent in asymmetric-based cryptosystems. Despite PKI's good features, its key validation mechanism has potential for delay and high resource requirements; making it not appropriate for use in resource-constrained environments like mobile phones. Thus, this work aims to develop an asymmetric-based secure mobile messaging application (dubbed "ProSMS") with improved efficiency during key validation when compared to PKI. A hybrid of symmetric (Twofish), asymmetric (RSA) and Hash function (SHA256) ciphers is implemented to add secure communication requirements to SMS messaging using J2ME programming. These security features were added to traditional SMS messaging with minimal overheads as indicated by the very low (< 1s) runtime requirements of the cryptographic processes. A new approach to public key verification/validation; dubbed SMS-Based Public Key Cryptography (SB-PKC) and earlier PKI were also implemented in the developed application in order to compare their key validation requirements. A major step used to differentiate SB-PKC from PKI is the elimination of the need for frequent request for keys' validity status information by users. The efficiency during key validation in SB-PKC was shown to improve over what is obtainable in PKI; (i) 40ms latency in SB-PKC as against 5000ms in PKI, the significance of which is that usability is improved as higher latency in wireless communication is known to hamper usability. (ii) 143 bytes and 472 bytes of request and response data sizes respectively are required in PKI as against 0 and 202 bytes data required in SB-PKC, the significance of which is that bandwidth-use optimization is higher in SB-PKC than in PKI. The test device used to arrive at these results is Tecno T9 mobile device.