A substantial body of research has focused on formalising what constitutes a ``secure'' messaging system, recognising that end-to-end encryption alone is insufficient to capture the full range of security, privacy, and usability properties that are expected by modern users. Several solutions have been proposed recently, including their own drawbacks, making the need for a direct secure messaging system a necessity. This paper presents Ember, a serverless peer-to-peer messaging system providing end-to-end encrypted communication over a decentralised IPv6 mesh network. Ember operates without central servers, enforces data minimisation through ciphertext-only local storage and time-based message expiration, and prioritises architectural clarity, explicit trust boundaries, and practical deployability on Android. The paper describes the system architecture, cryptographic design, network model, and security properties. Ember includes a ciphertext-only persistence model using an encrypted local database, ensuring that message plaintext is never written to disk. Through the integration of a time-to-live (TTL) mechanism for automatic message expiration, Ember enforces data minimisation on mobile devices. Ember is a layered and analysable system architecture with explicit trust boundaries separating user interface logic, cryptographic operations, storage, and networking components. The paper presents dynamic testing results demonstrating that no plaintext information can be recoverable from captured network traffic, and finally discusses limitations and future work.

翻译：大量研究工作致力于形式化定义“安全”消息系统的构成要件，认识到单纯端到端加密不足以涵盖现代用户所期望的全部安全、隐私及可用性属性。近期提出的若干解决方案均存在各自缺陷，这使得构建直接安全的通信系统成为迫切需求。本文提出Ember——一种无服务器点对点消息系统，通过去中心化IPv6网状网络提供端到端加密通信。Ember无需中央服务器运作，通过仅存储密文的本地数据库与基于时间的消息过期机制实现数据最小化，并优先考虑架构清晰性、显式信任边界及在Android系统上的实际可部署性。本文阐述了该系统架构、密码学设计、网络模型及安全属性。Ember采用仅密文持久化模型，通过加密本地数据库确保消息明文永不写入磁盘；通过集成生存时间（TTL）机制实现消息自动过期，在移动设备上强制执行数据最小化原则。Ember采用分层可分析系统架构，以显式信任边界分隔用户界面逻辑、密码学运算、存储及网络组件。动态测试结果表明，捕获的网络流量中无法恢复任何明文信息。最后讨论了系统局限性及未来工作方向。