⚠️ Warning: This implementation has not been audited. Use at your own risk!

PostGuard is an Identity-Based Encryption (IBE) service that can be used to encrypt messages. In Identity-Based Encryption, anyone can encrypt messages for one another. Instead of a public key, the sender only requires the master public key and an identity of the recipient. In order to decrypt, the receiver proves against a Private Key Generator (PKG) - a trusted third party - that he is indeed the correct recipient. Upon succesfully doing so, the receiver obtains a key that can be used to decrypt the message.

The repository consists of a workspace with four members:

PostGuard uses Yivi, a privacy-friendly identity platform, to authenticate these identities. These identities are stored on the users phone in the Yivi app in the form of uniquely identifying attributes. These attributes can freely and selectively be disclosed by the user to any party, but only with explicit consent of the user. Eventhough PostGuard uses Yivi, other authentication modules could easily be intregrated.

A typical PostGuard session can be depicted as follows. The red actions require user interaction. All other actions are automatic.

0. The PKG generates a public/private master key pair.
1. Alice's client retrieves the public master key from the PKG.
2. Alice uses the public master key and Bob's identity to encrypt a message.
3. Alice's client sends the ciphertext to Bob via a possibly untrusted channel/cloud storage.
4. Bob's client asks for a key to decrypt the ciphertext.
5. The PKG starts an authentication session at the Yivi server.
6. Bob is asked to reveal his identity, using a QR code.
7. Bob reveals his identity.
8. The Yivi server sends the authentication results to the PKG.
9. The PKG issues a key for Bob's identity.
10. Bob's client decrypts the ciphertext using his just obtained key.

Development of PostGuard was initially funded by the Next Generation Internet initiative (NGI0) and NLnet. The project is currently funded by a 4-year project from NWO under the name "Encryption 4 All".