Publishing an encrypted archive under a two-phase disclosure protocol with cryptographic commitment. Posting here because the verification architecture may interest folks working on cryptographic commitment schemes, verifiable disclosure design, or preservation tech. Verification tooling and commitment structure are included from the start.
Protocol structure
Phase 1 (now): encrypted vault (~3.21 GiB, gocryptfs) is downloadable. Alongside: the HMAC-Merkle root over decrypted contents (commitment), per-file ciphertext hashes, and full verification protocol in README.md.
Phase 2 (conditional): decryption passphrase and commitment secret S released simultaneously across multiple channels if a specific trigger event occurs. Downloaders can then verify the pre-committed root against actual decrypted content, proving no post-hoc manipulation by the curator.
Design keeps the curator honest: contents cryptographically locked at Phase 1 without revealing them; Phase 2 makes verification possible.
Publication probability (calibrated)
- P(we publish Phase 2) > 50%
- P(within 3-6 months | we publish) ~ 70%
Verification (public, doable now)
-
Whole-folder fingerprint for "documents" (SHA-256 of sorted concatenated per-file SHA-256s): 55e5130b330f7f2200f6475a5319cf77807da1cfc594e6fa4384c9a127bd6c6f
-
Phase 1 commitment (HMAC-Merkle root over decrypted contents, verifiable at Phase 2): d24aa4ae2edc8417cee5b66dfc791e4c8658ccbec67938af6ce0df3df3472d8c
Full verification workflow with Linux and Windows one-liners is in README.md inside the archive. All primitives are standard (SHA-256, HMAC-SHA-256, gocryptfs). Independent-implementation verification is encouraged.
Contents
Engineering documentation.
Includes a short video (AV-test.mp4) at archive root showing an antivirus on Windows scanning the archive in both unmounted encrypted form and mounted decrypted form.
Where
https://drive.proton.me/urls/8H8DDXSXJ4#hzc9QFQF3SEr
No financial ask
We seek no financial gain from this release and will never ask for money at any stage - not for the passphrase, not for early access, not for anything. Anyone asking you for payment is not us.
Same-actor verification (Nostr)
Future messages from us - including the Phase 2 release if it happens - will be signed by this Nostr identity:
npub: npub1rucycr77l3vx278mr7lhc3dl423jc0gaxrxk6z0qt08v5x3ja05qf9qjqk
view via web: https://njump.me/npub1rucycr77l3vx278mr7lhc3dl423jc0gaxrxk6z0qt08v5x3ja05qf9qjqk
Verify the signature on any claimed follow-up to confirm same-actor. Lemmy re-posts from this account may be intermittently reachable; the Nostr signature is the persistent anchor.
Notes
- This publisher may post [TEST] events on Nostr between Aug 11-15 to validate publish mechanisms. Ignore them.
Up to you whether ~3.2 GiB is worth it. The cryptography handles verifiability, content value is a separate question the post doesn't try to answer.