3 ms·

Kryptnostic lets you search fully encrypted data in the cloud

52 points by UnsungHero97 12y ago

TomcatEsq 12y ago
Does this maintain query privacy?
- geekbeast 12y ago
  Yes, but there are some limitations when doing server side sharing of documents without a central trusted authority. It's dangerous to accept shares from untrusted sources as it exposes you to attacks by malicious servers colluding or impersonating a user. Without using Oblivious RAM you risk losing query privacy, when indexing documents that consist of one word repeated many times.
mlmonkey 12y ago
This is interesting. Homomorphic encryption has been talked about a lot in the past, but no one had an efficient implementation. Good overview: http://www.americanscientist.org/issues/pub/2012/5/alice-and-bob-in-cipherspace/99999 http://www.americanscientist.org/issues/pub/2012/5/alice-and... Only problem is: the field is littered with patent landmines. It'll be interesting to see how these guys can work around that... http://blogs.teamb.com/craigstuntz/2012/04/04/38707/ http://blogs.teamb.com/craigstuntz/2012/04/04/38707/
- geekbeast 12y ago
  This is definitely an issue and has been for a few years now: http://community.embarcadero.com/index.php/blogs/entry/the-homomorphic-encryption-patent-land-rush-38707 http://community.embarcadero.com/index.php/blogs/entry/the-h... One thing in our favor is that we're not using a lattice or ring-learning with errors approach, which is where the majority of the patents lie. Our general IP strategy is to only use patents defensively, and make that technology available under open source licenses that allow unrestricted non-commercial use. We're also making all of our SDKs Apache v2 so that its easy to integrate into other software stacks.
  - anateus 12y ago
    Which type of fully homomorphic encryption are you using? Edit: Ah, found your patent: http://www.google.com/patents/US20130329883 http://www.google.com/patents/US20130329883
    - geekbeast 12y ago
      We'll have a more readable write up available on ePrint, soon.
deleted 12y ago
[deleted]
mazsa 12y ago
I do not dare to sign up via your https: https://www.ssllabs.com/ssltest/analyze.html?d=kryptnostic.com https://www.ssllabs.com/ssltest/analyze.html?d=kryptnostic.c... "This server accepts the RC4 cipher, which is weak. Grade capped to B." cf. http://www.isg.rhul.ac.uk/tls/RC4mustdie.html http://www.isg.rhul.ac.uk/tls/RC4mustdie.html
- geekbeast 12y ago
  We agree. RC4 must die. Will post back once we have resolved the issue.
  - mazsa 12y ago
    I noticed the change, thank you.
- geekbeast 12y ago
  Registration is a request to https://api.kryptnostic.com https://api.kryptnostic.com, which gets an A: https://www.ssllabs.com/ssltest/analyze.html?d=api.kryptnostic.com https://www.ssllabs.com/ssltest/analyze.html?d=api.kryptnost...

52 points by UnsungHero97 12y ago

TomcatEsq 12y ago

Does this maintain query privacy?

geekbeast 12y ago
Yes, but there are some limitations when doing server side sharing of documents without a central trusted authority. It's dangerous to accept shares from untrusted sources as it exposes you to attacks by malicious servers colluding or impersonating a user. Without using Oblivious RAM you risk losing query privacy, when indexing documents that consist of one word repeated many times.

mlmonkey 12y ago

This is interesting. Homomorphic encryption has been talked about a lot in the past, but no one had an efficient implementation. Good overview: http://www.americanscientist.org/issues/pub/2012/5/alice-and-bob-in-cipherspace/99999 http://www.americanscientist.org/issues/pub/2012/5/alice-and... Only problem is: the field is littered with patent landmines. It'll be interesting to see how these guys can work around that... http://blogs.teamb.com/craigstuntz/2012/04/04/38707/ http://blogs.teamb.com/craigstuntz/2012/04/04/38707/

geekbeast 12y ago
This is definitely an issue and has been for a few years now: http://community.embarcadero.com/index.php/blogs/entry/the-homomorphic-encryption-patent-land-rush-38707 http://community.embarcadero.com/index.php/blogs/entry/the-h... One thing in our favor is that we're not using a lattice or ring-learning with errors approach, which is where the majority of the patents lie. Our general IP strategy is to only use patents defensively, and make that technology available under open source licenses that allow unrestricted non-commercial use. We're also making all of our SDKs Apache v2 so that its easy to integrate into other software stacks.
- anateus 12y ago
  Which type of fully homomorphic encryption are you using? Edit: Ah, found your patent: http://www.google.com/patents/US20130329883 http://www.google.com/patents/US20130329883
  - geekbeast 12y ago
    We'll have a more readable write up available on ePrint, soon.

deleted 12y ago

[deleted]

mazsa 12y ago

I do not dare to sign up via your https: https://www.ssllabs.com/ssltest/analyze.html?d=kryptnostic.com https://www.ssllabs.com/ssltest/analyze.html?d=kryptnostic.c... "This server accepts the RC4 cipher, which is weak. Grade capped to B." cf. http://www.isg.rhul.ac.uk/tls/RC4mustdie.html http://www.isg.rhul.ac.uk/tls/RC4mustdie.html

geekbeast 12y ago
We agree. RC4 must die. Will post back once we have resolved the issue.
- mazsa 12y ago
  I noticed the change, thank you.
geekbeast 12y ago
Registration is a request to https://api.kryptnostic.com https://api.kryptnostic.com, which gets an A: https://www.ssllabs.com/ssltest/analyze.html?d=api.kryptnostic.com https://www.ssllabs.com/ssltest/analyze.html?d=api.kryptnost...