2

I am trying to find a good way to combine Owncloud with client-side encryption. Ideally, the requirements are:

  1. encryption relatively transparent (mostly text/.odt files) and cross-platform (Win, OS X, Linux)
  2. file-level encryption (so that versioning/backup still works)
  3. ideally files can be viewed server-side with a key (this will require a new owncloud plugin)
  4. sharing of files possible (ideally with multiple keys)

So far I have looked at:

  1. encfs, however, it is weak if an attacker has multiple versions of the cyphertext so is out.
  2. GnuPG looks more secure and definitely better for sharing, however, it's not so easy to do on-the-fly encryption like encfs does
  3. ecryptfs looks like a non-starter as it's linux only and would require monolithic files to be backed up.

Are there any suggestions for a way to use GnuPG so that it is relatively transparent to the user. Ideally it would be good to have a similar mechanism to encfs, in which a folder is created and all files put in that folder are encrypted with the appropriate sharing permissions. It would be best if files were stored individually (I know this leaks some info but also allows for owncloud versioning to work). Then the encrypted folder is synced to owncloud (and it shouldn't be too hard to write a GnuPG decrypt plugin for owncloud eventually)

5
  • 1
    "files can be viewed server-side with a key" - then you are losing most of the security benefits of encrypting client side.
    – symcbean
    Commented Dec 23, 2015 at 13:58
  • You're right, this would certainly compromise security but in some cases may be a feature requested by users with the appropriate caveats. I'm familiar to some degree with the arguments about it being very difficult/impossible to secure things properly once the browser is exchanging key data with the server.
    – FGiorlando
    Commented Dec 24, 2015 at 22:55
  • Any solution for this? I really like this set up.
    – eli
    Commented Apr 15, 2020 at 22:54
  • 1
    the best solution I have found so far is using GPG encryption with git filters. This meets most of the use cases apart from server-side viewing of files. I haven't reviewed @TheDudeAbides suggestion yet, but that may also be an option
    – FGiorlando
    Commented Apr 17, 2020 at 8:46
  • @FGiorlando, that's a creative solution! It's already got me thinking about Git LFS+Git hooks for some large repositories of (large) files that needed to stay encrypted-at-rest. I couldn't bear the thought of putting them inside of any kind of container, for fear the container itself would become corrupted, which my gut tells me is a legitimate concern to have.
    – Kevin E
    Commented Nov 24, 2021 at 10:28

1 Answer 1

1

Cryptomator can potentially meet at least some of your needs, and seems to be designed for this use in mind: that is, transparent client-side encryption/decryption of individual data files stored with a cloud storage provider, while obscuring filenames.

  1. encryption relatively transparent (mostly text/.odt files) and cross-platform (Win, OS X, Linux)
  2. file-level encryption (so that versioning/backup still works)
  3. ideally files can be viewed server-side with a key (this will require a new owncloud plugin)
  4. sharing of files possible (ideally with multiple keys)
    • this will certainly involve some manual inspection/comparison of, say, timestamps to determine which file to revert from the ownCloud interface, since filenames are obfuscated
  1. ¯\_(ツ)_/¯
    • I suppose it's possible, since other cloud storage providers have integrated it into their own web-based services according to this page on the Cryptomator site
  2. ehhhh, sorta, but probably not in the way that you'd hoped
    • this would be possible at the level of encrypted containers, if you shared the key file or passphrase used to unlock the container; this is easily done if you can meet the other person in the physical reality, not so straightforward across the InterWebs
    • and this is obviously not going to be integrated into ownCloud's built-in sharing workflow, such that you could just pick a username and click a big "Grant Access" button

Other notes

  • Recent versions of ownCloud have server-side encryption, as mentioned in this FAQ
    • not sure if this is a paid "Enterprise" feature nowadays or a "core" feature
    • this will not protect user data from local administrators, only encrypts it in transit to a third-party storage provider like Dropbox or Google Drive
    • ownCloud GmbH's original press release, from late 2018
  • Not much luck with searching for "client side encryption" on the ownCloud forums
3
  • I hesitate to recommend Cryptomator. It's immature with untested crypto.
    – eli
    Commented Apr 15, 2020 at 22:54
  • Nextcloud also has an alpha version of client-side e2ee but it's not really functional or stable yet: github.com/nextcloud/end_to_end_encryption_rfc/blob/master/…
    – FGiorlando
    Commented Apr 17, 2020 at 8:50
  • @eli - Cryptomator had a pentest audit performed in Nov 2017 that rated the cryptographic implementation as "quite exceptional". And it's now 2021 and I'm not aware of any breaches. It also uses tried-and-tested AES encryption, not some home-made solution. Would you still consider it "immature and untested"?
    – Simon East
    Commented Nov 23, 2021 at 3:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .