Assume we have a malicious storage server (a user-agnostic key-value store, supporting server.put(key, value) and server.get(key)) that we want to use for per-user based secure file storage. The two interfaces I want to make secure is client.upload(username, filename, message) and client.download(username, filename), which communicate with server.put() and server.get() behind the scene.


  • Each user has his/her private keys securely stored locally, and public keys stored on a secure public key server.
  • The malicious server may try to tamper with the uploaded message.
  • The malicious server can make a user upload arbitrary files with any name and content it wants.
  • The malicious server will not roll back a file, or delete it.
  • Filenames and file contents are non-empty.


  • The lengths of the filenames and file contents need not be confidential (e.g., the malicious server will not make the user upload one out of two files with different lengths, and try to guess which file he/she uploaded).
  • The filenames and file contents themselves must be confidential.
  • The client must reject any files that have been tampered with, or not uploaded by the specified user. (I.e., integrity and authentication.)

The design I'm thinking about is:

  • Key (to be used with storage server) = encrypt(filename, priv_key_1)
  • Value = signed(encrypt(message, priv_key_1), priv_key_2)

Is there any flaw in this design?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.