Live data from Hacker News

Client-Side Encryption: The Right Security Model for the Cloud

blog.balboa.io

11–20 of 29 posts

Re: Client-Side Encryption: The Right Security Model for the Cloud

#12

Client side encryption is definitely the way to go, soon enough computation will become possible on the encrypted data. Maybe there will be homomorphically encrypted virtual machines/ containers.

In my opinion, homomorphic encryption is the new quantum computing. Remember all the hype there was 15 years ago, around the time the first quantum computers were being demonstrated? I think homomorphic encryption will be the same: it's an interesting concept, and it has some specific use cases where it excels at, but I think we'll see that it doesn't really beat traditional encryption for most realistic needs.

Re: Client-Side Encryption: The Right Security Model for the Cloud

#13
post #3

I thought this article was interesting because the author talked about how encryption can be used to "delete" data from distributed systems instantly, by just removing the key. Not really a new idea, I don't think, but not one that gets surfaced much when people talk about client-side crypto.

Mobile operating systems often use that as a quick and solid-state-storage friendly way to clear devices.

And also for "deleting" an entire class of data from all of your backup media.

Re: Client-Side Encryption: The Right Security Model for the Cloud

#14
Writing Go code, I've always been frustrated at how writing code to encrypt/decrypt data always felt like brain surgery using the standard libraries. I wrote a simple library around NaCL's secretbox that has a very simple user-friendly interface, while (hopefully) also being secure.

https://github.com/ereyes01/cryptohelper

As far as the secure part, I'd appreciate eyes on the code (which there isn't a whole lot of) to verify this works well. This library could also possibly be enhanced to support other encryption methods, such as AES. An easy interface with sensible defaults to Go's AES interfaces would be nice.

Re: Client-Side Encryption: The Right Security Model for the Cloud

#15
post #4

Two projects for client-side encrypted cloud data: https://css.csail.mit.edu/mylar/ https://css.csail.mit.edu/cryptdb/ Microsoft also released a homomorphic encryption project for bioinformatics last week: http://research.microsoft.com/apps/pubs/default.aspx?id=2584...

Microsoft's Azure SQL Database also recently released a client-side encryption feature, called Always Encrypted:

https://msdn.microsoft.com/en-us/library/mt163865.aspx

Re: Client-Side Encryption: The Right Security Model for the Cloud

#16

Earlier quoted context omitted.

I like that you're using NaCl. I'm earmarking this for review later. :D

It's quite a coincidence that you posted this while I was writing up my own post evangelizing the virtues of NaCl :)

Different NaCl. Yes, the naming collision is unfortunate.

(https://developer.chrome.com/native-client vs. http://nacl.cr.yp.to)

Re: Client-Side Encryption: The Right Security Model for the Cloud

#17

I don't worry so much about encryption, since I am really not into keeping secrets, but I agree about the client-side part. ...and now a brief word from our corporate sponsors... Haha, not really :) I'm just trying to get the thing that I've been working on "out there". It's an operating system that runs in a web browser. How's that for client-side awesomeness? The current project I'm hawking is called "The Native Cl…

I'd love to chat with you about this, but your profile doesn't have an email address in it. Could you send me an email?

And for that matter, will you be at Chrome Dev Summit tomorrow?

Re: Client-Side Encryption: The Right Security Model for the Cloud

#18

Earlier quoted context omitted.

It's quite a coincidence that you posted this while I was writing up my own post evangelizing the virtues of NaCl :)

Different NaCl. Yes, the naming collision is unfortunate. ( https://developer.chrome.com/native-client vs. http://nacl.cr.yp.to )

I want to use NaCl with NaCl to connect to GCM using AES-GCM.

Re: Client-Side Encryption: The Right Security Model for the Cloud

#20
I keep wondering: Browsers have been dealing with some of these issues for quite some time now, both for SSL purposes and password storage. They should agree on common interfaces to expose safe crypto functions to client code, so that users could be relatively sure that servers will never get, say, a plaintext password. Is it terribly hard?

It would likely be safer than hamfisted attempts at JS cryptography which can be compromised down the wire.

Post reply on HN