Best user data encryption design patterns?

Question

Let's say that I have a website that allows users to upload files (much like Dropbox), and I need to encrypt those files so that only the users that have access to them can view the file data. Users need to be able to view the file names/sizes via a web interface (but nobody else should be able to), and download the unencrypted version when they want to. What would the most secure encryption setup be?

It seems to me that you could encrypt a decryption key with the users password (and associate that key with that user only/use it to encrypt his/her data), but then in order to access the file information or allow them to download the file data the server would have to have access to the decryption key past the login point. This would require persisting the user password in some capacity (or saving the decryption key) with the session, both of which seem very insecure. It has also occurred to me that we could (somewhat?) securely store a master key, but then the user data is at risk if that key is stolen.

How is this done in practice? Also, if anyone out there has any good articles/posts on this topic I'd be extremely interested to read them.

Answer 1

There is a spectrum of ways to provide this kind of online storage:

• Completely unencrypted: no protection at all

• Server-side site-wide encryption: the data is uploaded by the user in its unencrypted form, and stored on the remote server. The server has, for example, a fully encrypted disk. This only physically protects the data.

• Server-side individual keys: the server generates keys, provides key management, and provides all encryption/decryption for the user data based on the specific user. The server is aware of the key values.

• Client-side encryption: the clients handle the actual sensitive key material, handle all encryption and decryption, and technically handle the all of the key management functions (though the server keeps track of everything for you). The server cannot decrypt the data at all.

It sounds like you are wanting to provide a variant of client-side encryption where the server has no knowledge of the keys, but are caught up in the idea that the server has to provide the actual encryption/decryption service. You can't have both. You'll have to determine what your server is actually going to do. Is it simply a storage vehicle? Does there have to be collaboration? Do you want to be able to share the data among users? All of these questions influence the role the server will play and the actual use case/business case you are trying to solve.

In terms of actually creating the encryption key based on the user's password, you'll want to check out "password based key derivation." Such an encryption key could function as a master key for the other client-based keys.

Answer 2

Provide client-side en/decryption and provide the tool for the user. Because you want it simple, fast, strong, free, multi-platform (since you don't know what the user might be using) and very easy to use, I recommend the US Air Force's Encryption Wizard, see http://spi.dod.mil/ewizard.htm.

One great thing about Encryption Wizard is the cleartext metadata. Your website can read & publish this data (names, sizes, keyword, author, etc.)

Answer 3

As is often the case in security, a great place to start is by asking yourself: "What's my threat model?" What are you trying to defend against? Who is the adversary, and what are their capabilities and their motivations?

If you want to protect against the cloud provider, then you need to encrypt the data on the client side, so the file stored on the cloud is in encrypted form. For instance, you might take a look at Tarsnap, SpiderOak, or Wuala. If security is paramount, I would take a close look at Tarsnap; the author (Colin Percival) is a respected security engineer, who has been very open about his design, and I would expect Tarsnap's security architecture to be extremely thoughtfully designed.

If you are prepared to trust the cloud provider, then you have more options. You can either encrypt the data on the client side, or you can upload it to the cloud and let the cloud take care of protecting it (either by having the cloud provider encrypt it, or by relying upon the cloud provider to implement access control). For instance, Dropbox falls into this category.