7 ms·

My understanding is that SpiderOak, Tarsnap, and Wuala all do this correctly (using one of PBKDF2, bcrypt, or scrypt.) Colin - Perhaps the companies in the bac

My understanding is that SpiderOak, Tarsnap, and Wuala all do this correctly (using one of PBKDF2, bcrypt, or scrypt.) Colin - Perhaps the companies in the backup space that put effort into handling this carefully should work together and create a PSA style website with a matrix chart of how the varies providers handle "encrypted" data. Make it a separate domain and do our best to be elaborately objective about it. Any interest?

tptacek 15y ago
What block cipher mode does SpiderOak use, and how does it verify the authenticity of its data? Tarsnap goes through a lot of extra trouble to MAC its data; few other providers do. You'd hate to see everyone treat key derivation as a shorthand for "doing all of encryption right". I looked on the SpiderOak site, saw a lot of material on how keys are derived and not stored on SpiderOak servers (great!), but didn't see a lot of details about the mechanics of actually encrypting and checking data.
- rarrrrrr 15y ago
  Thanks for asking. If you're interested, would be very happy to discuss SpiderOak's crypto strategy in depth with you the next time I'm in Chicago. Could share source code, etc. IMO, most interesting parts are the key scoping, which allow users to selectively publish ("share") portions of stored data by publishing the appropriately scoped keys. SpiderOak uses AES256 in CFB mode with authentication via HMAC. The code is careful about unique nonce/counter usage, crypto code is confined to specific modules that rarely change, and reviewed by cryptographers outside SpiderOak. Client and server have minimal trust relationship. Being paranoid about data integrity (not only because of crypto issues, but also because bitrot happens routinely at petabyte scale) the data authentication happens repetitively at a few different layers. From all end user devices, we see about one bit error per 4.2tb of upload transactions.
  - Locke1689 15y ago
    Why CFB vs CTR? Is there some reason parallelization is unneeded or impossible?
    - tptacek 15y ago
      Also... what counters? (Regardless: happy to get together anytime in Chicago).
  - JoachimSchipper 15y ago
    If you're willing to talk publicly, I'd be interested in hearing more about your key scoping design.
cperciva 15y ago
Any interest? Not really. I've seen far too many "best practices" and "standards" bodies go nowhere to think that a committee can put together a useful website like this.
jasondavies 15y ago
A matrix chart sounds like a great idea. Anyone know if Backblaze handles this correctly? Here is a post describing their setup: http://blog.backblaze.com/2008/11/12/how-to-make-strong-encryption-easy-to-use/ http://blog.backblaze.com/2008/11/12/how-to-make-strong-encr...

tptacek 15y ago

What block cipher mode does SpiderOak use, and how does it verify the authenticity of its data? Tarsnap goes through a lot of extra trouble to MAC its data; few other providers do. You'd hate to see everyone treat key derivation as a shorthand for "doing all of encryption right". I looked on the SpiderOak site, saw a lot of material on how keys are derived and not stored on SpiderOak servers (great!), but didn't see a lot of details about the mechanics of actually encrypting and checking data.

rarrrrrr 15y ago
Thanks for asking. If you're interested, would be very happy to discuss SpiderOak's crypto strategy in depth with you the next time I'm in Chicago. Could share source code, etc. IMO, most interesting parts are the key scoping, which allow users to selectively publish ("share") portions of stored data by publishing the appropriately scoped keys. SpiderOak uses AES256 in CFB mode with authentication via HMAC. The code is careful about unique nonce/counter usage, crypto code is confined to specific modules that rarely change, and reviewed by cryptographers outside SpiderOak. Client and server have minimal trust relationship. Being paranoid about data integrity (not only because of crypto issues, but also because bitrot happens routinely at petabyte scale) the data authentication happens repetitively at a few different layers. From all end user devices, we see about one bit error per 4.2tb of upload transactions.
- Locke1689 15y ago
  Why CFB vs CTR? Is there some reason parallelization is unneeded or impossible?
  - tptacek 15y ago
    Also... what counters? (Regardless: happy to get together anytime in Chicago).
- JoachimSchipper 15y ago
  If you're willing to talk publicly, I'd be interested in hearing more about your key scoping design.

cperciva 15y ago

Any interest? Not really. I've seen far too many "best practices" and "standards" bodies go nowhere to think that a committee can put together a useful website like this.

jasondavies 15y ago

A matrix chart sounds like a great idea. Anyone know if Backblaze handles this correctly? Here is a post describing their setup: http://blog.backblaze.com/2008/11/12/how-to-make-strong-encryption-easy-to-use/ http://blog.backblaze.com/2008/11/12/how-to-make-strong-encr...