Quote

https://gli.ph/security2.html

You could've just used the open sourced Textsecure client and server crypto engineering which is known to be secure/audited with your custom UI/app to also send coins. Much easier than rolling your own. You can still sell the app if a lot of people use it regardless if it's guts are entirely made up of Textsecure with some added bitcoin functionality.

If the goal is to sell this software with custom crypto engineering you should consider message encryption using a fast native stream cipher like Salsa20 (or ChaCha) + polynomial MAC (Poly1305, VMAC). I would also use ephemeral keys, ECDH over Curve25519 or copy what Textsecure has done to create each session(s) with temporary keys. Ditch RSA +OAEP, just use a curve to derive a key it's much less complex. You save a lot of bandwidth too using Poly1305 which should be essential for any mobile app.

I assume you've also done self signed distributed certs or pinning http://thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/

Finally pay somebody respected to audit your software since money transactions and private messaging is involved. Ask this guy who respected crypto engineers are that can be contracted for auditing: https://twitter.com/matthew_d_green this will generate more interest in your app since none of us can verify the code.