Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Librevault: Open source zero-knowledge peer-to-peer file sync

librevault.com

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#21

Post by GamePad64 »

anateus wrote: post #19
Ar-Curunir wrote: post #8

I wish people would stop using the phrase "zero knowledge" willy nilly. It has a specific meaning within cryptography.

Yeah... I kept looking for the way this is ZK. Do they just mean that the files are encrypted on their servers and so they can't read them? I understand accidentally stepping on a term from an adjacent field, but using it this way for a product that presumably is crypto-centric is a bit of a red flag.

I have no server infrastructure. ZK in this context means, that you can create an encrypted share. But, I think, it is not an appropriate term here.

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#22

Post by GamePad64 »

sciyoshi wrote: post #17

Looks great! Any plans to document the synchronization protocol? I've been using SyncThing but it lacks the main feature I need, which is to selectively synchronize only certain files to other devices.

Yes. The protocol is pretty stable now, it hasn't been changed for a while and has necessary extension points, so I can add more features in the future. I will publish the protocol specification in two weeks.

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#24

Post by skrowl »

GamePad64 wrote: post #11
skrowl wrote: post #7

Earlier quoted context omitted.

SyncTrayzor (windows client implementing synching) is pretty nice. It runs as a tray icon but when you click it, it loads like a native app even though it's a web app (similar to electron)

But it is still a web ui, not a native one. Also, SyncTrayzor itself is not cross-platform, so Linux users have to install syncthing-inotify for watching the directories for changes.

It's network compatible with and syncthing clients. Syncthing is an open standard with dozens of client apps.

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#25

Post by swordswinger12 »

GamePad64 wrote: post #16
swordswinger12 wrote: post #13

Can you describe your file encryption procedure? In the Meta::Chunk class the 'encrypt' function only computes AES-CBC with no MAC, but there are calls to compute_strong_hash at other points in the library. There are references to a (non-cryptographic) Rabin hash as well as SHA2-224 and SHA3-224 in these functions - which is used for ciphertext authenticity and integrity?

During the indexing procedure, the value of SHA3-224(AES256(data)) is computed for each chunk. Then, the list of these hashes is placed into Meta structure. After that, this Meta is ECDSA-signed using a EC point, decoded from A-type secret. Any other type of secret contain the public part of EC point and can verify the signature.

So is there a per-chunk MAC, or do you rely on the signed hashes of ciphertext for the integrity and authenticity of each chunk?

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#27

Post by GamePad64 »

swordswinger12 wrote: post #25
GamePad64 wrote: post #16

Earlier quoted context omitted.

During the indexing procedure, the value of SHA3-224(AES256(data)) is computed for each chunk. Then, the list of these hashes is placed into Meta structure. After that, this Meta is ECDSA-signed using a EC point, decoded from A-type secret. Any other type of secret contain the public part of EC point and can verify the signature.

So is there a per-chunk MAC, or do you rely on the signed hashes of ciphertext for the integrity and authenticity of each chunk?

Actually, there is per-chunk HMAC support in the protocol and present revisions add HMAC for each chunk into Meta: https://github.com/Librevault/librevault-common/blob/master/...

This HMAC is computed over plaintext chunks and used to determine, if we already have this chunk in database (because of random IV we get different hash of ciphertext every time), not for verification.

And what is wrong about verifying integrity and authenticity by hash-then-sign?

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#28

Post by swordswinger12 »

GamePad64 wrote: post #27
swordswinger12 wrote: post #25

Earlier quoted context omitted.

So is there a per-chunk MAC, or do you rely on the signed hashes of ciphertext for the integrity and authenticity of each chunk?

Actually, there is per-chunk HMAC support in the protocol and present revisions add HMAC for each chunk into Meta: https://github.com/Librevault/librevault-common/blob/master/... This HMAC is computed over plaintext chunks and used to determine, if we already have this chunk in database (because of random IV we get different hash of ciphertext every time), not for verification. And what is wrong about verifying integ…

Maybe nothing, but it's just kind of a weird, nonstandard way of doing things. Also it's not immediately obvious to me that your method meets modern security definitions like IND-CCA2.

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#29

Post by rakoo »

ausjke wrote: post #9

Geez, that's what I am exactly working on off-work, slowly but the idea is nearly 100% identical.

Heh, me as well (https://github.com/rakoo/rakoshare) although I've been trying other technologies and combinations lately, slowing the development a lot.

Re: Librevault: Open source zero-knowledge peer-to-peer file sync

#30

Post by evolve2k »

Please add some basic instructions on how to use this on a local network.

I tried the following:

1. Download app and install

2. "Add folder" new key, select folder I want to sync. Ok. Folder did not then appear in the list as expected. It should it appear in the window straight away, right?

3. I then installed the software on another computer.

4. On other computer clicked 'Open URL' and added "lvlt:". OK. This did nothing either.

Where am I going wrong. Please add a basic getting started to your site which shows the basic steps to add a folder on one computer and then set up another computer to sync the folder down onto.

Looks like a great little app. thx in advance for your assistance.

Post reply on HN