I’m a developer and I’ve created websites and mobile/desktop apps for business and self-employees.

I’m a person who always liked privacy and I’m planning to create a Google photos open source alternative. Alternatives already exist but what makes this project different is that it’s going to be quantum resistant.

This is my plan:

  • Photos backups, sharing, see photos locations in Open Street Map.

  • Use recommended post quantum algorithms by The National Institute of Standards and Technology.

  • Take an hybrid approach, this is quantum and already known encryption.

  • Create the app with Material 3 design.

I’m just creating this post just to see if there would be people interested in this project and to ask if you could share your opinion.

  • Do you think there would be a market for this?

  • Would you be interested in being an early adopter and test it out?

Please share suggestions and opinions! 😁

  • @sloppy_diffuser@sh.itjust.worksEnglish
    2•1 year ago

    A few notes as I’ve been doing some PQ research for my own projects:

    • NIST PQ encryption algorithms are typically for encrypting small amounts of data due to poor performance (like an AES symmetric key)
    • NIST PQ encryption algorithms use public key cryptography to securely exchange keys between two parties (usually to establish a AES symmetric key… aka Key Encapsulation Mechanism, or KEM, with a Key Derivation Function, or KDF, which frequently uses Hash-based Message Authentication Code, or HMAC)
    • Hybrid-PQ, as you mentioned, should be used since there are not years of testing on the new PQ algorithms
    • AES256 is PQ with good performance, but lacks a way to securely exchange the shared key, so typically public key cryptography is used to bootstrap

    With that said, I’d want to know where and how the encryption is going to be applied.

    An ideal solution for me:

    • Data is stored using AES on device and remote
    • I have soul access to the AES key (can be derived, see last note)
    • App generates and index of meta searchable fields and thumbnails also AES encrypted, but is decrypted when opening the app to make it usable.
    • I can choose my backup (checkout rclone)
    • All over the top features like OSM are done client side (or self-hosted backend)
    • PQ would really only come into play to seal the AES key on my device. Instead of unlocking my photos with my AES key directly, its sealed behind a passphrase, pin code, hardware token, or other type of key. Pretty much what LUKs and Bitwarden do. Option for multiple keys would be great. A new device might take a passphrase and hardware key, but then might be sealed by a pincode.

    I suppose you could use a PQ TLS, but if the payload is already AES encrypted, I see little value. You could use PQ to sign each object I suppose in case your AES key is broken, but that would mostly detect tampering of the data.