Cryptographic Attribution and Immutable Decryption Provenance for Multi-Recipient Encrypted Document Distribution
Ministry of Defence · Blockchain & Cybersecurity · Software
Excellently specified and the post-quantum, air-gapped attribution demo lands hard with MoD — but the whole thing rests on watermark robustness, so build a watermark that survives a screenshot or print-scan rather than only a byte-identical copy, because that is exactly where a defence judge will attack it.
What it actually is
When one encrypted document goes to many recipients who each decrypt their own copy, a leak can't be traced — every recipient's decrypted copy is identical, so all are equally suspect, and server logs or shared watermarks can be forged or don't distinguish recipients. The ask is a system that stamps a unique invisible forensic watermark at the moment of decryption, cryptographically binds each decryption to the recipient's identity, and records it immutably so a leaked copy can be traced to exactly who decrypted it.
What to build
A broadcast-encrypt, individually-decrypt system where at decryption time each recipient's copy gets a unique invisible forensic watermark specific to their session — visually identical to every other copy but forensically distinct — the decryption event is signed with the recipient's own private key (non-repudiation) using NIST post-quantum algorithms for key exchange and signatures, and the signed record is committed to an offline tamper-evident blockchain/DLT ledger so no admin can alter it; given a leaked copy, the system extracts the watermark, looks it up against the ledger, and returns a cryptographically verifiable identification of the responsible recipient — all fully offline and air-gapped, with no cloud KMS or public blockchain.
Smallest thing that wins the room
Distribute one encrypted document to three recipients, have each decrypt (getting visually identical copies), then take one 'leaked' copy, extract its invisible watermark, look it up on the offline ledger, and produce a signed, verifiable record naming exactly which recipient decrypted that copy — all with the network disabled.
How crowded this one gets
A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.
Quieter than 77% of the 240 · #55 of 240 by expected field
Few teams are likely to go here. The best odds on the board come from statements like this.
Why: defence, intelligence and space bodies drew small fields.
This is a guess, not a fact
Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.
The scores
The number is the shorthand. The line under it is the reason.
Acceptance potential
4/5A strong pick — the spec is excellent, the post-quantum and offline framing lands hard with an MoD judge, and the attribution demo is compelling, but the watermark robustness is the make-or-break: a submission whose watermark survives only a byte-identical copy has solved the easy half, and a defence judge will ask how it survives a screenshot or print-scan.
Feasibility
3/5The cryptographic half — post-quantum signatures (ML-DSA), an append-only signed ledger, decryption binding — is buildable with existing PQC libraries, but the forensic-watermarking half is the genuinely hard part: an invisible, per-session watermark that survives the ways a document actually leaks (re-export, screenshot, print-scan, format conversion) is a serious research problem, and a watermark that only survives a byte-identical copy is easily defeated.
Innovation scope
4/5Binding decryption-time forensic watermarking to post-quantum non-repudiation and an immutable offline ledger into one attribution chain is genuinely open, and the robust-watermarking design — surviving realistic leak channels while staying invisible — is the real intellectual contribution.
Clarity
5/5Exceptionally precise: the threat model, the required watermark properties, the post-quantum requirement, the DLT audit layer, the full end-to-end workflow, and the strict offline/air-gapped, no-cloud-KMS, no-public-chain deployment constraints are all spelled out step by step.
Effort
MassiveBroadcast encryption, per-session forensic watermarking, post-quantum signing, an offline tamper-evident ledger and a watermark-to-ledger forensic lookup is a large cryptography-plus-watermarking build.
Demo-ability
EasyThree identical-looking decrypted copies, then tracing one leaked copy back to the exact recipient via the offline ledger, is a concrete and genuinely impressive demo — and the air-gapped constraint makes the network-off proof dramatic.
In its favour
- Green flag: The cryptographic half rests on standardised post-quantum algorithms with existing libraries, so signing and the ledger are buildable on solid foundations
- Green flag: Tracing one leaked copy of three identical-looking documents back to the exact recipient is a concrete, memorable demo, made dramatic by the air-gapped constraint
- Green flag: The post-quantum and offline framing lands directly with an MoD judge's priorities
- Green flag: The threat model and workflow are spelled out step by step, so there is no ambiguity about what to build
Against it
- Red flag: The forensic watermark is the make-or-break: it must survive how documents actually leak — screenshot, print-scan, re-export, format conversion — and a watermark that only survives a byte-identical copy is trivially defeated
- Red flag: Invisible-yet-robust watermarking is a serious research problem, and teams tend to build the crypto and under-build the watermark that the whole attribution depends on
- Red flag: The offline, no-cloud-KMS, no-public-chain constraints rule out convenient shortcuts, so the ledger and key management must be genuinely self-contained
- Red flag: A false attribution accuses the wrong person, so the binding and lookup must be cryptographically sound, not merely plausible
What you will be writing
- Post-quantum crypto (ML-DSA signatures, ML-KEM key exchange)
- Invisible forensic document watermarking
- Decryption-time per-session marking
- Offline tamper-evident ledger / DLT
- Watermark extraction + ledger lookup
- Air-gapped deployment, no cloud KMS
- Digital forensics
- Post-quantum cryptography
- Leak attribution
Prior art to read before you start
forensic watermarking for leak attribution · post-quantum non-repudiation · immutable decryption provenance
Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.