Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
As far as I understand Wuala (so called secure cloud storage) is not using the original (user provided) password to encrypt data so what role does original password play in their system?
I think they are generating a symmetric encryption key and somehow encrypt it with the original password, storing it along with the encrypted data on their servers. The question is how secure that encryption of symmetric key?
Wuala encryption is based on a Cryptree structure.
For descriptions of different technical depths cf. http://wualablog.blogspot.de/2011/05/wualas-encryption-revisited.html?m=1
Actually this done by many implementations of file system encryption, including truecrypt, first of all the key which is generated is significantly longer and complex than your password. The reason why they encrypt the key with your password rather than all files is because if you would change your password, all encrypted files would need to be decrypted first and the reencrypted with your new password. If you use the key for encryption, then you will only need to reencrypted the key with your new password. This has a lot less overhead and is equally secure.
