🔐 Open Image Network

Hybrid-decentralized image hosting with end-to-end and post-quantum encryption.

Upload → get a link → share it. No accounts. No tracking. No ads.

---

How it works

 Browser                        Gateway                         Nodes
    │                              │                               │
    ├── AES-256-GCM encrypt ──────→│                               │
    │   (key stays in browser)     ├── chunk + Reed-Solomon        │
    │                              ├── AES-256-GCM per chunk       │
    │                              ├── ML-KEM-1024 key exchange    │
    │                              ├── ML-DSA-87 + SLH-DSA sign   │
    │                              ├── distribute ────────────────→│
    │←── link with key in #fragment│                               │
    │                              │                               │
    ├── request image ────────────→│                               │
    │                              ├── verify PQC signatures       │
    │                              ├── pull from nodes ←──────────│
    │←── encrypted response ──────│                               │
    ├── HMAC-SHA256 verify         │                               │
    ├── AES-256-GCM decrypt        │                               │
    ├── display                    │                               │

The decryption key lives in the URL fragment (#key). Browsers never send fragments to servers. The gateway handles encrypted ciphertext only. Nodes store opaque blobs.

---

🔑 Encryption layers

Layer	Where	What
E2E	Browser	AES-256-GCM + HKDF-SHA256. Key never leaves your browser. HMAC-SHA256 integrity check in every link.
PQC	Gateway	ML-KEM-1024 key exchange → AES-256-GCM manifest encryption. Dual-signed with ML-DSA-87 + SLH-DSA-SHAKE-256s.
Transport	Everywhere	HTTPS between all parties.

---

🛡️ Post-quantum cryptography

Algorithm	Standard	Role
ML-KEM-1024	FIPS 203	Key encapsulation
ML-DSA-87	FIPS 204	Lattice signatures
SLH-DSA-SHAKE-256s	FIPS 205	Hash-based signatures

All three at Security Level 5 (highest tier). Classical AES-256 randomness combined with ML-KEM-1024 via HKDF-SHA3-256 both must be broken simultaneously. Dual signatures mean if lattice math breaks, the hash layer holds.

---

🏗️ Architecture

This is hybrid-decentralized. The gateway is a central coordinator it receives uploads, encrypts, distributes to nodes, and reassembles on download. It does not store data permanently. Nodes are the persistent storage layer holding only opaque encrypted blobs they cannot decrypt. If the gateway goes down, share links stop working until it returns. Node data is preserved.

crates/
├── oin-core/     Crypto, chunking, erasure coding, PQC, manifests
└── oin-node/     Storage daemon with multi-disk support and gateway sync

---

⚡ Quick start

Download a binary

Grab the latest from Releases:

Platform	Binary
🪟 Windows x64	oin-node-windows-x64.exe
🍎 macOS Apple Silicon	oin-node-macos-arm64
🍎 macOS Intel	oin-node-macos-x64
🐧 Linux x64	oin-node-linux-x64

Then run it:

# Linux / macOS
chmod +x oin-node-*
./oin-node-linux-x64

# Windows
oin-node-windows-x64.exe

That's it. No config, no port forwarding, no accounts. The node connects and starts storing encrypted chunks.

Build from source

git clone https://github.com/VinavilDev/OpenImageNetwork.git
cd OpenImageNetwork
cargo build --release -p oin-node
./target/release/oin-node

---

_{Built with Rust. Secured with <3 and Sweat.}