Inspiration

Sensitive documents shared within defence, government, and other high-security organizations must remain confidential even after authorized recipients decrypt them. However, when the same document is distributed to multiple recipients, identifying the source of a leak becomes extremely difficult because every recipient may possess an identical copy. Traditional access logs can be vulnerable to privileged tampering, while static watermarks cannot reliably distinguish individual recipients.

This inspired us to build TraceSeal, a secure document distribution system designed around one central principle: decryption itself should create the forensic fingerprint. We wanted to combine post-quantum cryptography, invisible watermarking, and a tamper-evident distributed ledger to make document distribution more accountable, verifiable, and resilient against insider threats.

What it does

TraceSeal enables authorized recipients to access sensitive documents while generating a unique, invisible forensic fingerprint for each decryption session. Its major capabilities include:

Invisible forensic watermarking: Embeds recipient-specific fingerprints into visually indistinguishable document variants.
Post-quantum cryptography: Uses NIST-standardized algorithms, including ML-KEM for key establishment and ML-DSA for digital signatures.
Quorum-based key release: Requires cooperation among multiple key-release authorities rather than trusting a single administrator.
Tamper-evident audit ledger: Records important identity, authorization, and decryption events with cryptographic integrity checks and distributed verification.
Leak investigation: Analyzes a recovered document, extracts its forensic fingerprint, and matches it against recorded decryption sessions.
Independent evidence verification: Provides an exported evidence bundle that can be verified offline without relying on the live application.
Air-gapped deployment: Is designed to operate without cloud key-management services or public blockchain networks.

Together, these capabilities help investigators establish a verifiable link between a leaked document and the corresponding recorded decryption session.

How we built it

We designed TraceSeal as a modular, self-hosted security platform with separate components for identity management, document preparation, cryptographic authorization, key release, forensic analysis, and audit verification.

The document pipeline prepares visually indistinguishable variants at selected word positions. During an authorized decryption session, the system selects variants according to a recipient-specific fingerprint. Tardos-inspired fingerprint coding supports statistical analysis of potential collusion attacks.

We integrated post-quantum digital signatures to authenticate authorization requests and a threshold-based key-release workflow to prevent unilateral access to protected key material. A multi-replica ledger maintains tamper-evident records, while the forensic pipeline uses image alignment and template matching to recover fingerprints from distorted document captures.

The platform also includes a web console for demonstrating identity enrolment, document distribution, recipient access, leak investigation, ledger integrity checks, and evidence verification. We developed automated tests and a reproducible demonstration workflow to validate the implemented components.

Challenges we ran into

One of our biggest challenges was ensuring that forensic fingerprints remain detectable without visibly changing the document. Even tiny differences can be affected by image compression, cropping, rotation, blur, screenshots, and print-and-scan operations.

Another challenge was balancing fingerprint uniqueness with resistance to collusion. A fingerprint that distinguishes individual recipients is not automatically robust when multiple recipients combine their copies. We therefore incorporated Tardos-inspired coding and an attack-testing workflow to evaluate attribution performance.

We also had to ensure that the cryptographic trust chain remained consistent across identity management, key-release authorities, and ledger replicas. Quorum authorization, signature verification, ledger integrity checks, and offline evidence verification all required careful integration and testing.

Finally, creating a convincing demonstration required us to distinguish genuinely implemented functionality from future enhancements and to make failures, authorization denials, and integrity violations visible rather than hiding them.

Accomplishments that we're proud of

We are proud to have developed TraceSeal around a distinctive security concept: generating the forensic identity of a document during decryption rather than relying solely on static, pre-distribution watermarks.

Our key accomplishments include:

Integrating post-quantum cryptographic operations into the document authorization workflow.
Implementing multi-party approval for identity enrolment and threshold-based key release.
Developing a multi-replica, tamper-evident audit architecture.
Building a forensic pipeline for fingerprint extraction and attribution analysis.
Creating an independent verifier for exported investigation evidence.
Developing an interactive web console that demonstrates security controls and exposes important system events.
Establishing automated tests and attack scenarios to evaluate correctness, integrity, and forensic performance.

These achievements represent our effort to move beyond ordinary encrypted file sharing toward a system that supports accountable access and independently verifiable leak investigations.

What we learned

Building TraceSeal taught us that secure document distribution requires more than strong encryption. Encryption protects confidentiality, but it does not by itself identify the source of a leaked plaintext document.

We learned how post-quantum cryptography, digital signatures, threshold authorization, distributed ledgers, forensic watermarking, and statistical attribution can work together as parts of a larger security architecture.

We also learned the importance of adversarial testing, reproducible experiments, and honest reporting. A successful attribution must account for detection errors and false accusations; a tamper-evident ledger must be evaluated against its actual trust assumptions; and a cryptographically valid record must not automatically be treated as proof of malicious intent.

Most importantly, we learned to design security systems around verifiable evidence rather than relying exclusively on administrator trust.

What's next for TraceSeal

Our next steps are to strengthen TraceSeal through broader evaluation and deployment-oriented improvements.

We plan to expand testing against real-world screenshot and print-and-scan conditions, evaluate larger recipient groups and more sophisticated collusion strategies, and measure false-positive and false-negative attribution rates across independent test sets.

We also aim to improve the document viewer, integrate the complete distribution-to-investigation workflow into the web console, strengthen operational key management and recovery procedures, and conduct independent security reviews of the cryptographic protocol and ledger architecture.

Our long-term vision is to make TraceSeal a practical, offline-first platform for accountable distribution of sensitive documents in defence, government, research, and other environments where confidentiality, insider-threat detection, and trustworthy evidence are essential.