Skip to content
Marko Ivanovski

Secure file sharing with zero-knowledge proof authentication

A file-sharing service where users authenticate by zero-knowledge proof, so the server verifies the secret without ever receiving it.

category
academic
year
2025
status
completed
role
One of three on the project
  • Docker
  • Flask
  • PostgreSQL
  • Python

What it is

A file-sharing web app for an information security course, built with two colleagues, where the password never leaves the browser. At registration the browser derives a secret from the password and a per-user salt and sends only a public key. At login it answers a Schnorr challenge, so the server verifies the user without ever storing a password hash.

Uploaded files are encrypted at rest with AES-GCM and hashed with SHA-256 for integrity. Private files can be shared through links that expire after 5, 10 or 20 minutes. It runs as Flask and Postgres behind self-signed HTTPS, in Docker Compose.

  • Authentication by zero-knowledge proof rather than by sending a credential to be checked.
  • A Flask service over Postgres, with the full design written up in the repository.

What I learnt

  1. The project I learned the most from. With two colleagues I implemented zero-knowledge proof authentication, so logging in proves you know the password without ever sending it.
  2. Securing the whole path of a file: per-user salts, SHA-256 hashes for integrity, and encryption of the contents before anything is stored.

What I would do next

Nothing essential. I might rebuild it with a better architecture.