I'm looking to deploy a solution where large files are generated on the server containing customer sensitive information. Customers' can then login and download these files.

My question is "is there a zero knowledge encryption solution I can use for this?". Basically I want the files to be encrypted on my server and only the customer is able to decrypt them, preferably through a website and not having to run a command line tool. I've been looking into private key encryption options, but cannot see anything that suits.

  • 2
    Since you're generating the files, zero-knowledge doesn't apply here... – Stephen Kitt Nov 17 '16 at 15:40
  • Well, sort of... The files are generated by us but using information the customer adds, which we don't have access to. I suppose we could potentially hack the files at the stage of inception, but for the sake of this discussion let's say we have no access to these files until they are moved to the file storage area. It is in file storage area where I want to encrypt them and prevent anyone apart from the customer gaining access. – Ben Nov 17 '16 at 15:47

Asymmetric encryption is ideally suited to this: your customers would generate a private/public key pair, provide you with the public key, then on your inception system you encrypt the files using that public key (before the files get to the storage area). Once that's done, no-one can decrypt the files without the private key, which means only your customers can decrypt the files (and only their files).

Finding a user-friendly approach to all this used to be difficult, but it's getting better, and there are browser-based solutions such as OpenPGP.js which is used by ProtonMail. OpenPGP.js seems to support key management and decryption (which is what you'd need on the client side); on the server side you can use that or GnuPG or any other OpenPGP-compatible tool.

You still need the customers to trust that you're not accessing their data in the inception area!

| improve this answer | |
  • Thanks! this is exactly the type of solution I was thinking of. Where I'm getting stuck is finding one of those user friendly solutions. Can you suggest any? – Ben Nov 17 '16 at 16:12

I suggest you have a look at Mailfence. From what I know they are the only provider for that user friendly solution

source: http://www.emailquestions.com/encrypted-email-service-providers/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.