I'm evaluating a cloud storage product. The marketing literature states it uses Cryptree. I pulled the paper and performed a quick read, but I don't see where Cryptree lends itself to confidentiality and integrity from semi-honest employees and legal attacks like National Security Letters.
In fact, I'm not sure what the security goals are because they are not succinctly stated. Section 1 Introduction does discuss three goals, but they are related to efficiency and design; and not security.
The abstract does say something about untrusted storage, but the term is never defined. So its not clear to me if the only thing untrusted is the access control mechanism for the remote or distributed file system. The abstract is reproduced below.
I've also read 2.1 Key Management in File Systems several times, but its not clear to me how confidentiality and integrity is achieved with semi-honest employees and legal attacks because the system is clearly using symmetric keys.
Question: Is Cryptree suitable for cloud storage when a requirement is confidentiality and integrity from employees and government?
I have not pulled the source code at this point, but I might need to to see some of the design and implementation details. I'm especially interested in what goes on with the node that represents the root of the tree (and other keys that are based upon it (re: key regression and key updating)).
I placed the question on InfoSec.SE because I think the security goals of the file system are in purview, and its closer to design and implementation. Please let me know if I should flag for migration to Crypto.SE, which tends to be more theoretical.
We present Cryptree, a cryptographic tree structure which facilitates access control in file systems operating on untrusted storage. Cryptree leverages the file system’s folder hierarchy to achieve efficient and intuitive, yet simple, access control. The highlights are its ability to recursively grant access to a folder and all its subfolders in constant time, the dynamic inheritance of access rights which inherently prevents scattering of access rights, and the possibility to grant someone access to a file or folder without revealing the identities of other accessors. To reason about and to visualize Cryptree, we introduce the notion of cryptographic links. We describe the Cryptrees we have used to enforce read and write access in our own file system. Finally, we measure the performance of the Cryptree and compare it to other approaches.