Is SpiderOak truly “zero-knowledge”?

Question

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to the server.

I was quite surprised when I found out the password updated itself automagically.

So I sent a question to SpiderOak. Here is what they replied:

I must point out that if you change your password, these updates will be detected across all of your machines because SpiderOak encrypts your password and the encrypted password is sent to the server then distributed to each device. Each device is able to decrypt the password and update to the new changes.

By changing your password, you have created a new set of encryption keys. All keys are encrypted with 256 bit AES, using a key created from your password by the key derivation/strengthening algorithm PBKDF2 (using sha256), with a minimum of 16384 rounds, and 32 bytes of random data ("salt"). This approach prevents brute force and pre-computation or database attacks against the key.

I don't really understand. How is a device able to decrypt the newly created password?

Answer 1

Disclaimer: I have never tried using spider oak so I'm only by going what they claim they do, what they told you they do and what the end result looks like.

Given that they claim to be storing your data encrypted and never being able to access it, I would assume the only thing they ever have access to is really the encrypted version of your data. This would mean the application on the client performs all the encryption/decryption operations and only stores the resulting data (and possibly extra encrypted metadata on the server).

This data must be encrypted by something. Now going by their response to you, I would assume they have some hierarchy of keys. My guess would be at least 2 levels, but for simplicity let's just assume one.

This would mean the data is encrypted by some randomly generated key K₁ (on your machine). This key is then encrypted by a key K₂=PBKDF(32 byte salt,password,16384 rounds). By the preceding ugly description I mean they use the PBKDF2 (Password Based Key Derivation Function v2.) algorithm (using SHA-2) to generate an encryption key from your password. This key K₂ would never be stored anywhere (except client memory). It would always be generated on the fly when you want to access your data.

The package that would then be sent to and stored on the Spider Oak servers would be E_K1(data),E_K2(K₁). When you then want to retrieve the data you get the data sent over to you encrypted, and the key sent over to you also encrypted. When you enter your password, PBKDF2 is used to generate K₂ which is used to decrypt K₁, which is then used to decrypt your data.

So what happens when you change your password? Well the server sends your client all the packages E_K2(K₁)$ for any K₁'s it has for your data. Locally these get decrypted by the key generated from the old password, and reencrypted by the key generated from the new password, which gives a new K'₂.

When you then come to a different device, fire up your client and try to retrieve your data, the encrypted data come accompanied by the key encrypted using you new password. You enter the password, PBKDF2 does it's magic, and voila you decrypt K₁ and then decrypt your data.

edit: GAH how do I get TeX to work here in my posts?

Edit2.: Rereading the information you got from the representative it actually seems like all new K₁'s are also generated. This seems somewhat fishy in the sense that either they do encryption/decryption on their servers (thus it's not fully zero-knowledge) or they send all the data back to you when you change your password and your client reencrypts it. The first of these seems more likely to be honest, since the overhead for the client otherwise would be quite large. Ofcourse it's also possible the representative doesn't really know what he's saying. I've had that happen multiple times.

Answer 2

Well, they can encrypt the new password by the old password or by some key exchanged between the machines prior the password change. This is the way they could do that.

However, I don't have the source code and don't surely know that.

Answer 3

DRF is probably correct in that the password is encrypted locally with your private key and not accessible to SpiderOak itself.

However to the more general question in the title I would say not.

Deduplication is an information leek. https://spideroak.com/faq/what-is-deduplication

Think about how this could work. Either they store a hash of the unencrypted data or use the same AES encryption key and salt for the two files. Neither are ideal.

They are based in the USA and as such are subject to the local data protection laws - or lack of.

Shared files are stored decrypted on their servers a trap for people who may have assumed otherwise. https://spideroak.com/faq/do-sharerooms-violate-zero-knowledge We would hope that sharing a file requires downloading, decrypting locally and reuploading in the clear and NOT decrypting on the server.

They have a device registration feature that keeps your computer logged in all the time. If you loose a device you must manually deregister the device from another computer. This forces the user to remember to logout all the time. https://spideroak.com/manual/security--access

When you close your account they have will eventually delete your files meaning they know what files belong to you and that's also an information leek.

This is not a fault of SpiderOak and is likely common to all providers of similar 'features'. To me features often mean added risks especially if they are backed on top of the encryption after the fact.