How adarshh025/tracecrypt works
TraceCrypt is an offline, post-quantum document attribution system. A sender packages an encrypted document for certified recipients; on decryption, the recipient receives only a uniquely watermarked document after an attribution event is signed and submitted to the permissioned ledger. If a copy leaks, an investigator extracts its watermark, verifies the ledger and cryptographic evidence, and produces a verdict and proof bundle. The graph retains these distinct stages and the local API/UI. Links for unsampled subsystems follow documented capabilities; uncertain implementation wiring is omitted.
Main entry points: attribution_pipeline.py Decryption attribution · engine.py Investigation engine · certificate.py Certificates · package.py Package creation
Components 21
Identity and crypto
- Root CA
tracecrypt/identity/ca.py - Certificates
tracecrypt/identity/certificate.py - PQC crypto
tracecrypt/crypto
Document workflow
- Package creation
tracecrypt/document/package.py - Encryption and wrapping
tracecrypt/document/encryption.py - Package validation
tracecrypt/document/validator.py - Decryption attribution
tracecrypt/document/attribution_pipeline.py - Watermarking
tracecrypt/watermark
Permissioned ledger
- Signed events
tracecrypt/event - BFT ledger
tracecrypt/ledger/node.py - Ledger storage
tracecrypt/ledger/storage.py
Forensic investigation
- Evidence ingestion
tracecrypt/forensics/ingestion.py - Investigation engine
tracecrypt/forensics/engine.py - Watermark extraction
tracecrypt/watermark/extractor.py - Proof and verdict
tracecrypt/forensics/proof_bundle.py
Local interface
- Local API
tracecrypt/api/app.py - Web UI
tracecrypt/ui/web/app.js - Local metadata store
tracecrypt/storage/sqlite_store.py
Other components
- Sender
- Recipient
- Investigator
Connections 22
- Sender → Package creation: submits document
- Package creation → Encryption and wrapping: encrypts and wraps
- Package creation → Certificates: uses recipient certificates
- Root CA → Certificates: issues
- Recipient → Decryption attribution: decrypts package
- Decryption attribution → Package validation: validates package
- Decryption attribution → PQC crypto: decapsulates keys
- Decryption attribution → Certificates: checks credentials
- Decryption attribution → Watermarking: embeds watermark
- Decryption attribution → Signed events: builds and signs event
- Decryption attribution → BFT ledger: submits transaction
- Signed events → PQC crypto: signs with
- BFT ledger → Ledger storage: persists chain
- Investigator → Investigation engine: submits leak
- Investigation engine → Evidence ingestion: ingests evidence
- Investigation engine → Watermark extraction: extracts watermark
- Investigation engine → Ledger storage: looks up event
- Investigation engine → Proof and verdict: creates proof and verdict
- Investigation engine → Certificates: validates identity
- Web UI → Local API: sends requests
- Local API → Local metadata store: reads and writes metadata
- Local API → Ledger storage: retrieves ledger events