Apparently the 'secure' cloud-encryption service BoxCryptor supports master keys for encrypted files.

Decrypt every file which is accessible by any member of your organisation.

How would a 'master key' be securely implemented in practice, not specific to BoxCryptor? Would each file be encrypted twice: once with the user's key and once with the master key? Or is there some way to encrypt a file such that either of two keys, but only those two keys, could decrypt the file? Short of encrypting twice, I don't see how that is possible.

  • 2
    It would be possible to encrypt the actual key used to encrypt the data twice, once with the user key, and once with the organisation key, which minimises the duplication.
    – Matthew
    Apr 27 '16 at 8:43
  • @Matthew: So each user's decryption key is stored, itself encrypted, by the service provider?
    – dotancohen
    Apr 27 '16 at 9:00
  • Other way round. Service provider provides a (probably symmetric) key for the data, which is encrypted with both the user's key, and the organisation key. If this is a public/private setup, they wouldn't be able to decrypt that symmetric key (don't have the private keys).
    – Matthew
    Apr 27 '16 at 9:08

In regards to Boxcryptor, every user has its own RSA key pair which is generated locally on his device and the private key is encrypted with a so-called password key. The password key is derived using PBKDF2-SHA512 from the user's password. The encrypted private key and the public key are stored on Boxcryptor's servers for Boxcryptor accounts or in a local key file for Local accounts.

The master key is a separate RSA key pair and the private key is also encrypted with a password. In order to "activate" the master key for a user, his password key is encrypted with the public master key and the encrypted password key is then stored at Boxcryptor's servers.

Whenever the company needs access to a user's files, it can use the private master key to decrypt the user's password key and then use the password key to decrypt the user's private key.

You can read more about it in the official technical overview: https://www.boxcryptor.com/en/technical-overview#anc05


The way I would implement it is probably similar to the way many storage providers with encryption capability do.

A random key symmetric is generated and used to encrypt the data. 2 copies of the symmetric key are then encrypted, one with a user asymmetric public key, and one with the master asymmetric public key. Only the private keys can then decrypt the file decryption key and thus the data.

It is possible that for legal reasons, the storage provider encrypts a third copy with their own key, so that data can be decrypted if they are served with a warrant. If that kind of system is required, I would use a per account warrant public key, from a private key which was generated from a seed. The private key is no longer stored, and a large amount of computing power is required to regenerate the private key from the seed using a deterministic process (say 100 billion hash iterations and 4 gigs of ram). The seed would then be stored securely in the same way that cryptographic keys are.

BoxCryptor however is different from a cloud storage provider, they are a cloud cryptography provider. The way they do it means the symmetric key is generated by you, and they manage only the public keys so that other users can access the file. That means they never see private keys or file keys, and they have no access to the encrypted data. The encrypted files are then passed to the actual storage provider, which generally would have seen the plaintext, would have access to the file key, and would be able to provide decryption to law enforcement.

Providers like BoxCryptor may also store an encrypted copy of your private key (I believe they do), which is downloaded to the client and decrypted with a password. BoxCryptor may also encrypt file keys with additional keys such as group keys and those of additional users, so they can also access the file.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .