4

I've done a bit of research on client-side encryption, I've looked on Wikipedia and various other sources, I was just curious, however, if you had a network administrator watching over all traffic, all POST data, etc. would client-side encryption help hide messages being sent/received so that the net admin would not be able to read them?

Improve this question
0

2 Answers 2

Reset to default
10

would client-side encryption help hide messages being sent/received, so that [my local network administrator] would not be able to read them?

Client-side encryption is not about transport encryption. The point of client-side encryption is not whether an eavesdropper can capture your communication on the way to a server. Rather it's about encrypting data without involving another party (i.e. the service provider, "the server") in the process.

Client-side encryption just means that the server doesn't encrypt the data which it's storing for a user by itself, but leaves the encryption to the client, giving the client full control over the process. This way the service provider is proving that they can't access the plaintext because they never handled the encryption keys in the first place. In theory, this means you don't need to trust the service provider to handle your data confidentially. (In practice, you'd have to verify that the provided client application actually implements CSE as promised by the provider.)

Whether the client-side-encrypted data is transferred securely (over an encrypted channel between you and the server) is a separate issue.

Improve this answer
2
  • Huh? If you always encrypt messages on a client and send encrypted messages, then an eavesdropper can't read them, right? It doesn't matter if you're sending them over an insecure channel
    – Jezzamon
    Dec 31, 2017 at 5:44
  • 1
    @Jezzamon It does matter. There are different security requirements between transport encryption and encrypting local files. Also, you're possibly giving an attacker the opportunity to tamper with the data transfer. If I sent you an encrypted string over an insecure channel, a MITM couldn't decrypt it, but they could exchange it with something else or forge your response that you received the string or notice that it didn't change since the last time.
    – Arminius
    Dec 31, 2017 at 10:11
5

Client-side encryption means that the client is encrypting the data and NOT sharing the key with the server. When done properly, this would prevent anyone without the key from deciphering the data.

For example: if I encrypt my files before storing them in S3, this is client-side encryption. As long as my key is secure and the encryption algorithm is safe (both of which are complicated enough to get right), no-one outside my computer can see the actual data. This includes my ISP, any network hop between myself and S3, the S3 admin, and anyone who can access the file in S3.

This usually means that the server is storing a random "blob" of data. It does not know how to read it, or what it is.

Improve this answer
2
  • So if we had Alice and Bob under the same network, with an admin who is constantly viewing their data being sent to each other, how would I go about encrypting their messages so that the admin could not view them?
    – Hugh Chalmers
    Dec 30, 2017 at 17:05
  • 1
    @HughChalmers: That's transport encryption, which is unrelated to clientside encryption (they can be used in tandem if desired). In practice that generally means using TLS
    – BlueRaja - Danny Pflughoeft
    Dec 30, 2017 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .