Our Student's Achievement: Iriszip - Secure File Transfer, Straight from the Browser

At SCSA, nothing makes us prouder than seeing our students turn knowledge into real products. Today we'd like to introduce Iriszip, a browser-based file transfer tool built by Shota Mamisashvili with security considered at the design level from the start

What is Iriszip?

The idea grew out of a simple problem: transferring a file between two devices without installing an app, creating an account, or being locked into a particular ecosystem.

Today, all it takes on iriszip.com is opening the page on two devices and pairing them with a 9-digit code or a QR code. If both devices are on the same network, files travel directly over the local network; otherwise the system attempts a direct P2P connection and only falls back to a relay server when needed - a relay that sees nothing but encrypted bytes. Nothing is stored anywhere: when the session ends, the data is gone. Alongside files, text can be sent as well.

Security as Part of the Architecture

As the project matured, security became its defining feature:

• Pairing is built on the SPAKE2 protocol with the full 9-digit code, 3 digits of which are generated in the browser and never reach the server.
• The session key combines classical X25519 with post-quantum ML-KEM-768 via HKDF-SHA-256 - a hybrid approach that prepares the protocol for the quantum era.
• Data is encrypted with ChaCha20-Poly1305.

SCSA's Role: Independent Cryptanalysis

SCSA conducted an independent cryptanalysis and protocol security assessment of the project's cryptographic protocol design. It's important to note that the review covers the protocol design, not the implementation - the public certificate lists precisely which security goals were examined and which remained out of scope. This kind of transparency is the foundation of the responsible security culture we teach our students.

Open and Verifiable

Iriszip is an independent, fully open-source project: it's free to use, requires no account, and can be self-hosted on your own infrastructure if you wish. The code running on the site matches the repository byte for byte - and anyone can verify that.

Congratulations to Shota on this achievement! We wish him success in further development of the project. Projects like this are exactly why we do what we do at SCSA - knowledge that becomes practice.

🔗 iriszip.com 🔗 github.com/iris-zip/iris