PrivateSphare

PrivateSphare is a secure, anonymous, zero-knowledge file storage and sharing platform. It allows users to upload files and receive a human-readable 24-word passphrase for retrieval. No accounts, no tracking, and no unencrypted data ever touches the server's persistent storage.

🛡️ Key Features

• Post-Quantum Security: Files are encrypted using a Quantum-Safe Hybrid scheme (Kyber1024 + AES-256-GCM) that protects against future quantum computer threats.
• Zero-Knowledge Encryption: Files are encrypted in the browser's context (client-side intent) using a key derived from a 24-word BIP-39 passphrase.
• Metadata Privacy: Filenames and MIME types are encrypted before being stored in the database.
• Opaque Storage: Files are stored in S3/MinIO under random UUID keys. Not even an administrator can identify what files are stored.
• Auto-Destruction:
  • Auto-Expire: Files are automatically deleted 24 hours after upload via S3 Lifecycle policies.
  • Wipe-on-Retrieval: Files and metadata are immediately destroyed as soon as they are successfully retrieved.
• Dual Limits: Standard 100MB upload limit, unlockable to 1GB via a Premium code.
• Modern UI: Fully responsive design with automatic Dark Mode support and a "Done" security flow to protect passphrases in browser history.

🛠️ Tech Stack

• Backend: Rust (Axum, Tokio, Tower-HTTP)
• Database: SurrealDB (v2.1.4)
• Storage: MinIO (S3-Compatible)
• Frontend: Handlebars templates, Tailwind CSS
• Security: Argon2id KDF, Kyber1024 (PQC), AES-256-GCM Encryption, SHA-256 Hashing, JWT (for Premium sessions)

🚀 Getting Started

Prerequisites

• Docker & Docker Compose (or Podman & Podman Compose)

1. Configuration

Copy the example environment file and update your secrets:

cp .env.example .env

Edit .env to set your SURREAL_PASS, S3_SECRET_KEY, PRIVATE_SPHARE_PREMIUM_CODE, and PRIVATE_SPHARE_JWT_SECRET.

2. Deployment

Run the full stack:

docker-compose up -d --build

(Or podman-compose up -d --build)

The application will be available at http://localhost:3000.

🔒 Security Architecture

1. Key Derivation: The 24-word passphrase is SHA-256 hashed and then passed through Argon2id with a unique 16-byte salt to derive a 64-byte seed.
2. Post-Quantum Layer: The seed is used to deterministically generate a Kyber1024 keypair. A shared secret is encapsulated using the public key, producing a Kyber ciphertext.
3. Symmetric Encryption: The shared secret is used to encrypt the data with AES-256-GCM.
4. Storage Layout: The final blob contains the salt, nonce, Kyber ciphertext, and AES ciphertext. This hybrid approach ensures that even if classical AES is compromised, the PQC layer remains secure.

📜 License

Created by Daniel Shamany. Designed for privacy.