Agreed, no magic here. I rolled a quick version using Squid and greasy spoon. Got it to work on SFDC and Gmail inside of a day. Using tags around the encrypted content and regex you could then feed the content into the decryption engine. Search works, etc. You could even using a unique IV per user to add a level of security, but it is by no means rock solid. It would however address some of the frequency analysis con…
Maybe the correct response here is an open source version of CipherCloud, built on open/published principles (to make it easy to verify the level of security provided).
The response will be along the lines of "lacks our secret patent-pending military grade algorithms".
Agreed, no magic here. I rolled a quick version using Squid and greasy spoon. Got it to work on SFDC and Gmail inside of a day. Using tags around the encrypted content and regex you could then feed the content into the decryption engine. Search works, etc. You could even using a unique IV per user to add a level of security, but it is by no means rock solid. It would however address some of the frequency analysis con…
Maybe the correct response here is an open source version of CipherCloud, built on open/published principles (to make it easy to verify the level of security provided).
I would be happy to post my code, but honestly the process is so embarrassingly simple, I'm sure other could do it better. Setting up the squid proxy with SSL bump was more difficult than the code, as there are some great libraries out there. Using a reverse proxy and Icap server, you need to parse all content using something like jsoup (regex if you really wanna hack). Jsoup grabs the element and you then run it through a great encryption library like bouncy castle you then add some unique identifiers arounds it (!!) so that you can decrypt it using simple parsing to get the encrypted content. Plop it back into the content using your trusty greasy spoon. And walla magic! All persisted data is encrypted. When data is pulled out you simply parse for the unique tag, and then run it through the decryption side. There are a number of things that you can do to increase the security of this implementation, with a little tweaking it works for searching, and the such, so gmail is no problem. An app like SFDC with joins between records would be significantly more difficult to do properly. Doing it improperly is trivial, as you could just just all of the same keys and IVs per org (the unit of work in SFDC).
Here is a link to the DMCA notice, in case anyone cares. Its not just a DMCA notice, it contains claims against slander and defamation too. http://www.pdf-archive.com/2013/04/20/notice130419/
»CipherCloud's product is NOT deterministic.« No, really, it is not. They say it three times. Who has not at least once dreamed of having your data processed by a non-deterministic system?
> their desire to suppress the use of their copyrighted IP in critiques of their product Which is a textbook case of fair use. They may want to do that, but legally, they almost certainly can't.
An example needs to be set. They should be sued for issuing a DMCA notice in bad faith.
Actually, is a DMCA notice against something that's fair use technically bad faith? You are still violating their copyright, you just have a defense against it in court.
Ultimately, whether something is fair use or not is the purview of the courts. Does the DMCA require you to make that judgement before submitting a notice? I would guess not.
And unfortunately, you can't sue people just for being jerks.
I didn't follow this story. Where can I find more information about this "Controversy"?
Basically, someone called out CipherCloud on apparently bogus claims about what they provide (homomorphic encryption). CipherCloud responded with DMCA takedown notices. Now they are trying to explain their actions, with a lot of "trust us, we are only hiding the crypto details because we need to maintain a competitive advantage!"
One correction: I don't think CipherCloud have actually claimed to do homomorphic encryption - at least I can't find any such statement on their web site. That was an assumption on the part of the StackExchange user.
It would be hard for them to make a security guarantee that isn't bogus, if the screenshots from their demo is an accurate representation of their technology, but they don't appear to have made this particular fraudulent statement.
"All of our customers, that I know of, have selected our solution as the recognized standard for cloud information protection after a thorough evaluation, testing, and scrutiny of our product’s design and implementation by their cryptographers and key management experts."
If you had to guess, how many of CipherCloud's customers do you think keep cryptographers on staff?
Here is a link to the DMCA notice, in case anyone cares. Its not just a DMCA notice, it contains claims against slander and defamation too. http://www.pdf-archive.com/2013/04/20/notice130419/
»CipherCloud's product is NOT deterministic.« No, really, it is not. They say it three times. Who has not at least once dreamed of having your data processed by a non-deterministic system?
I think they are claiming that they are not using deterministic encrpytion[1], which can be used to allow searches of encrypted data, not that their software is "non-deterministic".
»CipherCloud's product is NOT deterministic.« No, really, it is not. They say it three times. Who has not at least once dreamed of having your data processed by a non-deterministic system?
I think they are claiming that they are not using deterministic encrpytion[1], which can be used to allow searches of encrypted data, not that their software is "non-deterministic". [1] http://en.wikipedia.org/wiki/Deterministic_encryption EDIT: Or maybe you know that and I missed the joke.
I know the difference between probabilistic and deterministic encryption but I did not think of it at the time I read the PDF and posted the comment. »[Our] product is NOT deterministic.« instead of »Our encryption algorithm is not deterministic.« tricked my brain into visualizing their software as a random number generator. So it is good that you point that out, I misinterpreted their statement.