Secure Identity Auth for UIDAI

Run a face-liveness model inside someone's browser and you have handed them the model. They can swap it, edit it, or roll it back to a version that thinks a printed photo is a real person. That was the problem UIDAI put out at Smart India Hackathon 2024.

We stopped trusting HTTPS alone and treated the models like secrets. The browser and server agree on a key with ECDH, the model ships AES-encrypted, and its hash is RSA-signed so a tampered or downgraded model refuses to run. Aadhaar OTP and session checks sit on top.

Team of six. I worked on the frontend, the backend, AWS and the crypto flow.

We won, out of 300,000+ participants. UIDAI took our code after the win.