First of all, nice work! Learning by doing is great, especially with cryptography.

Some observations from a very quick scan:

1. You should include a disclaimer somewhere in the repo that this is an educational project, not something people should seriously use. This is the "escape hatch" for the "don't roll your own crypto" rule.

2. You're rolling your own curve math, including ECDH and ECDSA. These are not easy to get right; in particular, it looks like you've got a classic "attacker can send you a point not on the curve" bug here[1], unless I'm missing where you validate the other party's point.

3. Your protocol seems to allow variance over the curve parameters, which is notoriously dangerous (and is why X.509 and similar protocols prefer "named curve" sets over explicit parameter sets).

[1]: https://github.com/vaktibabat/ecurvechat/blob/4a1d91bd02bbc8...

I think size of the readme covers #1

Thank you! I'll try fixing these.

Implementing an Elliptic curve correctly is tricky, and in your post a quick CTRL-F didn't turn up the phrases "constant time" or "side channel". A good next step would be to look up various side channel attacks on elliptic curve implementations and work through mitigating them.

Also, your README needs a disclaimer, like others have said.

Thanks! Mitigating side channel attacks does seem like an interesting next step, I'll try doing it.

I love the learning project :)

Now invite people to break it

Thank you :)