I'm developing an app for alert people if they encounter covid-19 positive person. I'm very much concern about user's privacy. So I need to make a user completely anonymous.
What is want is as follows.
Suppose there are devices A, B, C,
A, B, and C should broadcast the their own UUID via bluetooth When A, B, and C is near to each other A will have B, C UUID's and B will get A, C's UUID and vise versa.
Lets suppose A's find out that A is positive for Covid-19. A will upload its UUID to a central server B and C also checks for UUID's with the server. When B, C gets UUID list of infected person's apps B, C will check if they match any of UUID downloaded from the server against locally saved UUID.
But in my case I don't want the server to find out UUID of A. But somehow I need to send A's UUID to other devices as well. Whats will be the best approach.
All the devices will generate public, private key pairs of their own. Each app will encrypt their UUID with the public key they have generated and broadcast to the other devices encrypted UUID + public key.
Once particular user find him positive for covid-19 he will upload his private key to the server. All the apps will download all the private keys from all the covid positive devices. and check if app's themselves can decrypt their messages with the private key's they have.
Will this be possible ? or what will be the best approach.
Its stupid to disclose the private key. And also it will be chaos to find appropriate public key which matches with the private key also.. But yet this was the only thing that I could think of.