Live data from Hacker News

Finally Bitcasa CEO Explains How The Encryption Works

techcrunch.com

41–42 of 42 posts

Re: Finally Bitcasa CEO Explains How The Encryption Works

#41

I would argue that you can either have data de-duping or encryption, but not both. If encryption is defined as: Transforming data so that only people with special knowledge can read it. Then if you can compare a chunk of encrypted data against another chunk to determine the source data... Well now you have very weak encryption because you could brute force it if you have a large enough repository of user files.

While technically correct, that's not a practical observation. A memory bank storing your “large enough repository of user files” would consume the entire universe.

That said, people don't store random bitstrings. People store music on these shared storages--if I were a big media company I could find all the MP3's of songs I own floating around P2P networks, compute their encrypted forms and subpeona the storage company for user accounts storing any one of the the files. People have also been known to synchronize application data, including files with secret keys or passwords, which in this case effectively shares a hash of the password. That's better than dropbox, but still if the key + normal file variation doesn't have enough entropy an attacker could brute-force the contents of the file.

EDIT: Those are just potential real-world attacks I can think of on the spot; I'm sure there are plenty of others. While this is certainly (marginally) better than Dropbox, real security and data de-duplication are mutually exclusive.

Re: Finally Bitcasa CEO Explains How The Encryption Works

#42
post #35
post #10

Academic paper on convergent encryption: http://www.ssrc.ucsc.edu/Papers/storer-storagess08.pdf TL;DR version: take a chunk of data, encrypt it with its own sha1 hash as the key. Now you have an encrypted version that you can dedup. You can only decrypt if you already know the hash. Info about who owns any particular chunk is not kept on the server, so even if you break in to the server, all you can tell is which chu…

How would I know the hash? I'd have to save the individual key(hash) for every file I upload? Also, if I wanted to know if you had a specific file (and I had access to all your encrypted files) this would be trivial, correct?

> How would I know the hash? I'd have to save the individual key(hash) for every file I upload?

Yes, but that's no different from keeping any other kind of directory structure. And you can apply the same trick to the directory structure itself, so all you really need to keep is a "root hash" to your (encrypted) directory.

> Also, if I wanted to know if you had a specific file (and I had access to all your encrypted files) this would be trivial, correct?

What do you mean by "I had access to all your encrypted files"? If you've broken in to the server, everything is encrypted, including the directories. The only thing you can tell is whether a particular encrypted block corresponds to data that you already possess (or possessed at some time in the past). But that by itself tells you nothing.

Post reply on HN