4

I want to store some files on a server, but need them to be encrypted, so that encryption/decryption happens only on the client.

An obvious choice would be something like a truecrypt volume that is accessed over webdav/ftp .. but the problem here is that the entire volume needs to be transfered (twice) for each change that happens to any of the files inside the volume.

Are there any other solutions? Maybe something like truecrypt with built-in remote access functionality? Or a webdav/ftp-like protocol with finer granularity for block- rather than file-level access?

Or should I be approaching this from an entirely different angle?

5
  • Do you need the communication to be encrypted or just the files on the remote server? Have you looked into encrypting the entire drive and using a VPN to access the data? This would encrypt remotely and securely transfer files via encrypted communication.
    – kobaltz
    Jan 3, 2012 at 17:21
  • 1
    I didn't worry about the data transfer itself because I figured I could always resort to sftp or a ssh tunnel for that. Encrypting the entire drive is imho not an ideal option because once the drive is mounted everyone with access to the system can see it. Plus, the encryption key needs to be sent to the server.
    – Dexter
    Jan 3, 2012 at 17:32
  • 2
    Why not encrypt each file individually? That way you can keep them anywhere.
    – Nifle
    Jan 3, 2012 at 17:46
  • 1
    Which operating system are you using? If you have support for FUSE and EncFS, your files can be encrypted transparently. Thus, it will not matter where you upload to. (Dexter's Lab was my favorite show as a child.)
    – iglvzx
    Jan 3, 2012 at 19:20
  • That looks like the right tool, thank you! .. Now I just need figure out how to get it working on Windows. Dexter brings up some good memories, yes :D
    – Dexter
    Jan 4, 2012 at 2:03

3 Answers 3

1

I think the ideal solution for you is BoxCryptor. It encrypts each file individually so you won't need to transfer whole volume if only one file was changed, and it is free if total size of your files is less than 2GB. Filenames are encrypted as well. I use it with Dropbox and it works perfectly.

2
  • 2
    Looks interesting, but with closed-source programs for encryption there always remains the doubt wether the devs might not have made a mistake somewhere that weakens the enrcryption or allows others to bypass it entirely.. Especially when it's just a small startup and not a lot of people have taken a shot at cracking their tool.
    – Dexter
    Jan 4, 2012 at 2:12
  • Accepted this as the right answer after all, since BoxCryptor is just an encfs clone .. using encfs4win provides essentially the same functionality for free, and is open source. Thanks!
    – Dexter
    Jun 9, 2012 at 1:30
2

iSCSI will expose a file or disk partition as a block device to a remote system. If your remote host supports iSCSI or can run an iSCSI server (iet on Linux, not sure what options are there for Windows) then this would work.

(Just a note: I have used the combination of the iSCSI server [aka "target"] running on Linux and the iSCSI client [aka "initiator"] running on Windows XP, it worked pretty good. iSCSI initiator support is built in to Vista and 7 and can be downloaded/installed for XP)

Both Windows and Linux support mounting iSCSI volumes (a.k.a. iSCSI target), and you should be able to make it a Truecrypt partition just like any other disk partition/block device.

Truecrypt encrypts before writing to the block device, and decrypts after reading from it. So the remote iSCSI server ends up just receiving and sending encrypted data that it can't possibly know what to do with, and all encryption/decryption is done on your end.

You also might want to look into Tahoe-LAFS which is explicitly designed with this goal and redundancy in mind.

1

You could use a TrueCrypt volume, and use UNIX's rsync to move only the deltas (it works even with binary files).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .