How could a system be zero-knowledge?

Question

I'm actually interested about zero-knowledge storage system. Those system where the storage provider claims he can't have any access to the data stored.

As far I know, the data are encrypted using a symmetric encryption system, such as AES or another, But those systems need a key to function.

So what happens to the key? Is it stored? Where? If a user connects from another location, and wants to retrieve one of his files, he must retrieve the key first. So if the storage provider stores the key too, he could have access to the encrypted data. It's like having a chest locked and the code on a paper next to the chest, and then claiming that you couldn't open the chest.

So is there a flaw in that? I'm I mistaking completely about those zero-knowledge system? If they can finally open the file, how some of them could escape justice by saying "We can not know that we are hosting illegal files?"

Answer 1

In the simplest models for symmetric (reversible) encryption, you just need a decryption key - which can be as simple as a common password.

For the system to be zero-knowledge, the encryption must be done on the client's system and ONLY encrypted information passed to storage provider. This way the storage provider technically has the data stored, yet it has no way to access the clear text (human-readable un-encrypted version) because it doesn't have the key.

Note that in the old-days, we did this with simple FTP and "password protected ZIP files".

The weakness of this system is then that if the decryption key is just a common password then the storage provider (or anyone that intercepts the data) could trivially brute-force crack it and get the clear-text.

So, to make this system even more safe and robust, usually a public-private key system is used, again with the client's private key always being left on the client and NEVER given to the storage provider. Any storage provider that accepts or can access the decryption key is not zero-knowledge, by definition.

As you point out, this could be inconvenient - if I store information with the provider and want to access it at home, I have to manage the key myself. Many tools exist for this, from "keyrings" to secure USB dongle's to biometric storage devices with TPM chips, etc. But yes, you have to carry the key around with you or store it on some other provider's server, with all the potential dangers and inconvenience that has.

The simplest way to understand the systems is just to compare them to a keyed safe. You put in things you don't want anyone to touch, and you lock the safe. You give the safe to a storage company, and then you have the security of knowing the storage company only has access to your safe - not it's contents. If you also have the storage company store the keys to the safe, well then obviously they could trivially access it anytime they want.

The price of security and privacy is very often inconvenience - sometimes tremendous inconvenience. You just have to decide if what you gain is worth the price you must pay in time and potential insecurity (if you lose your key that data is pretty much gone forever, no one can get it back for you).

Answer 2

The answer BrianDHall provided is correct but I wanted to add a few more details around the idea of "Zero Knowledge" as it is only true in the context of removing the ability for the storage provider to decrypt your files.

Other meta attacks on such systems do exist and may be launched by the provider in cooperation with say the police (or other government organisation) or by an attacker who has direct access to the servers or a trojan on your client device.

A trojan could log key strokes exposing your private password rendering the whole thing pointless.

If you have an account with any of these providers you have probably given them your user name, email address, credit card information that links back to you.

Then consider how does the provider delete encrypted files once you close your account? The only way they can do that is by linking your user name to the encrypted objects in the store. So now meta data such as the number of files, possibly the tree structure used to store them, the size, the dates and times those files were created and accessed.

If I'm a movie studio and want to work out who has uploaded a movie, I might encrypt and upload it to my own account determine the encrypted object size and then ask the provider for a list of names of people who have stored the same size objects and then send all those users a legal looking thread asking for payment and see who bites.

It all depends on the specific implementation and how much trust you place in the storage service provider.