As AWS S3 already keeps files encrypted. What could be the use case where we need to encrypt our file using any other library explicitly. Is that required in real world application ?

Is it really required to encrypt files explicitly our self knowing that S3 will keep everything encrypted ?

  • 1
    Do you know the difference between client-side and server-side encryption? – forest Jul 30 '19 at 9:27
  • In this context how does it fits? Considering you have a dropbox like browser base client server application – Manish Kumar Jul 30 '19 at 9:44

In terms of explicit versus implicit use of cryptography, most of the time it is the latter that is most widely used on the internet (i.e. when sending an email or making an https connection, it all happens in the background through trusted software) but the choice of which to use should depend on the degree of trust in an implicit process, for example.

  • Regarding the part of the question about the need to encrypt prior to uploading to a service that will encrypt the data anyway, I think that also depends on the level of trust and level of security needed.

For example: some services don't have access to encrypted data as the encryption takes place client-side, where only the resulting cipher-text is held on the server, however, most of the time this requires a trusted setup where you are trusting the service provider's web interface or desktop software to allow the local client-side encryption to take place.

If a user didn't completely trust this process another option would be to encrypt their data themselves explicitly beforehand, and then import/upload as-is with no subsequent encryption by the service (if that option is available), or the service would encrypt the already encrypted ciphertext anyway (obviously with a different key) so that even if that service was compromised and that ciphertext would be decrypted, it would only decrypt to the initial ciphertext, and not the underlying plain-text (unencrypted data). This would be a form of double-encryption.

  • 3
    So to summarize: you encrypt it yourself before uploading it if you don't trust AWS (or whoever is storing your data) to keep your data secure. I don't have a source, but IIRC, apple actually stores all iCloud and other data for users on AWS, but they encrypt it themselves using their own key management system before sending it up to AWS. – Conor Mancone Jul 30 '19 at 12:20
  • 1
    So you are that for the sack of trust on third party storage better do own encryption and then store it on third party disk? – Manish Kumar Jul 30 '19 at 16:02
  • Yes @connor, and yes manish, in case you wanted that extra layer of protection, and keeping in mind the trade-off of extra security comes with extra responsibility for the additional key to manage. – Steven Hatzakis Jul 31 '19 at 11:52

Read the Capital One case and you'll know why application encryption is useful. Former Amazon employee ripping client data. Over $100 mln. in damage.

krebs on security


It depends:

  • You use Amazon's encryption in case you trust them not sharing your data.
  • You use your encryption software because you trust it, but not Amazon.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.