Introduction

Encrypted data rooms in DRACOON work very similarly to unencrypted ones. The only difference is that all contained files need to be encrypted by the clients before uploading them. To ensure the functionality, all FileKey management needs to be done properly.

Client-side encryption: Overview

Before uploading a file to an encrypted data room, it needs to be encrypted by the client with an appropriate crypto mechanism. We version the different applied crypto algorithms in order to be able to exchange them over time whenever necessary.

The currently used crypto versions are:

• A for symmetric encryption
• A for asymmetric encryption

Encrypting files

Each file needs to be encrypted before being uploaded with a symmetric crypto algorithm like AES. To do so, a new random key (the FileKey) is created by the client application and used to encrypt the file with the desired crypto algorithm (e.g. AES-256-GCM which is symmetric crypto version A).

Encrypting FileKeys

After encrypting the file with the FileKey, the latter itself needs to be encrypted before being transmitted to the DRACOON server. To do so, the client downloads the current user's asymmetric key pair (e.g. RSA-2048, which is asymmetric crypto version A) and encrypts the FileKey with the user's public key. The newly generated UserFileKey for the current user can then be transmitted together with the encrypted file to the DRACOON server.

Distributing UserFileKeys

After uploading a file together with the current user's UserFileKey, the file is available on the DRACOON server. However, it is inaccessible by all other users since they are not able to decrypt the UserFileKey (which is only encrypted for the current user and can only be decrypted with his/her corresponding private key). Therefore, a distribution of UserFileKeys is necessary.

To do so, the client can request the public keys of all authorized users for the newly uploaded file and encrypt the FileKey with them as well. This process grants access to all other users as well as creates rescue keys.

Decrypting files

A user may download any file from an encrypted data room that he/she can access, which means that a UserFileKey is available for this file for the current user. If that is the case, the user can download the encrypted file, the encrypted UserFileKey, and the own asymmetric key pair.

The private key from the key pair is used to decrypt the FileKey from the encrypted UserFileKey, which is then used to decrypt the actual file. Once again a combination of symmetric and asymmetric cryptography is applied.

Implementing client-side cryptography

If you plan to implement upload and download mechanisms for DRACOON Server, we suggest that you employ one of our open-source Crypto SDKs (currently available for Java, C#, and Swift), which are freely available on GitHub.

If you want to go into further details and implement the crypto application yourself, please have a look at the more detailed technical documentation of DRACOON's client-side encryption.