End-to-End Encrypted File Sharing with Verifiable Keys
A file sharing service where the server stores only ciphertext and can never read a file, with key verification so users can detect a server substituting keys. Correct key management is the whole difficulty, and the honest write up of what the design does not protect against is half the marks.
Advanced
Needs a team, real planning, and a supervisor who knows the area.1 semester, 2 to 3 students
5 to ship
3 optional extrasSuggested stack
What you should ship
- Client side encryption with keys derived in the browser and never transmitted
- Per file symmetric keys wrapped with each recipient's public key
- Key fingerprint verification allowing two users to confirm keys out of band
- Revocation and expiry with a clear statement of what revocation can and cannot achieve
- Threat model document stating precisely what the design protects against and what it does not
If you have time left
- Forward secrecy through key rotation
- Encrypted searchable filename index
- Third party review of the protocol design by someone outside the project
The problem
Most cloud storage is encrypted in a way that still lets the provider read your files, because the provider holds the keys. End to end encryption removes that, at the cost of making key management the user's problem.
What you build
Browser side encryption using platform cryptography, per file keys wrapped for each recipient, fingerprint verification, and a documented threat model.
The attack the fingerprints defend against
If the server distributes public keys, the server can hand you its own key instead of your recipient's and read everything. This is the central weakness of every such system, and out of band fingerprint comparison is the standard defence. Implementing and explaining it is the core of the project.
The write up that earns the marks
An honest statement of limitations. Your system does not protect against a compromised browser, a malicious client update served by your own server, or metadata analysis showing who shared with whom and when. Saying so precisely demonstrates real understanding; claiming complete security demonstrates the opposite.
The rule that is not negotiable
Use the platform's cryptographic primitives. Never implement a cipher. The project is protocol design and key management, and rolling your own cryptography is the one thing guaranteed to make it insecure.
Scope warning
Two party and small group sharing. Large group key management is a research area.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Every session is free; a few slots open each week.
Follow along
New writing, resources and project ideas land here first.