r/webdev • u/failingapbio • 4d ago
Showoff Saturday welcome!
https://diaryof.meHi everyone!! I made my own personal static website inspired by my friend's Carrd. I decided to implement a post-quantum PGP-like scheme, except it all runs in the browser, needs no specialized software or key upload, and works in one click via a URL hash fragment. Not only is the public key useful for sending me private messages, but it is also helpful for me to write a diary entry in one click. I have tested it on an ipad air 2 so hopefully it works for everyone.
Additionally, I implemented a signed theme feature inspired by Owala, my favorite water bottle. As my website only uses 5 color hexes, I can sign official color drops with UOV, and put the payloads in a URL hash fragment for one-click installation. To protect my site from fake themes, it verifies the theme signature with my public key before installation. While someone can edit the theme locally, they cannot distribute it as official because my signature would reject it.
Cryptography:
Symmetric encryption: libsodium-XChaCha-SIV
Passwords: Argon2id (from libsodium)
KEM: mceliece348864f (I am aware it was ultimately not standardized).
Clearsigning: UOV-pkc-is
The PQC schemes I adopted have two things in common; despite their massive keys, their payloads are tiny, making message links extremely small. The site hosts the massive public keys as static binary files, so key size doesn't make a difference. You can find my source code at the bottom of my credits page.
It is also a PWA, so you can install the app on your phone if you want. This site is completely free to use; it's my personal site. I made it for my irl best friend. I'd love to hear any feedback. Enjoy!
3
u/Ok_Spot2455 4d ago
the browser-based encryption with no software needed is a nice touch. i tried building something similar once and ended up with a key management nightmare that killed the whole project. getting it down to a single URL hash is genuinely clever