<description>Server side encryption of files. DEPRECATED. This app is no longer supported and will be replaced with an improved version in ownCloud 5. Only enable this features if you want to read old encrypted data. Warning: You will lose your data if you enable this App and forget your password. Encryption is not yet compatible with LDAP.</description>
<description>Server side encryption of files. Warning: You will lose your data if you enable this App and forget your password. Encryption is not yet compatible with LDAP.</description>
// - Add a setting "Don´t encrypt files larger than xx because of performance reasons"
// - Transparent decrypt/encrypt in filesystem.php. Autodetect if a file is encrypted (.encrypted extension)
// - Don't use a password directly as encryption key. but a key which is stored on the server and encrypted with the user password. -> password change faster
// - IMPORTANT! Check if the block lenght of the encrypted data stays the same
/**
* Class for common cryptography functionality
@ -52,7 +60,7 @@ class Crypt {
}
}
}
return $mode;
}
@ -61,7 +69,7 @@ class Crypt {
* @return array publicKey, privatekey
*/
public static function createKeypair() {
$res = openssl_pkey_new();
// Get private key
@ -76,9 +84,46 @@ class Crypt {
}
/**
* @brief Add arbitrary padding to encrypted data
* @param string $data data to be padded
* @return padded data
* @note In order to end up with data exactly 8192 bytes long we must add two letters. Something about the encryption process always results in 8190 or 8194 byte length, hence the letters must be added manually after encryption takes place
*/
public static function addPadding( $data ) {
$padded = $data . 'xx';
return $padded;
}
/**
* @brief Remove arbitrary padding to encrypted data
* @param string $padded padded data to remove padding from
* @return padded data on success, false on error
*/
public static function removePadding( $padded ) {
if ( substr( $padded, -2 ) == 'xx' ) {
$data = substr( $padded, 0, -2 );
return $data;
} else {
# TODO: log the fact that unpadded data was submitted for removal of padding
return false;
}
}
/**
* @brief Check if a file's contents contains an IV and is symmetrically encrypted
* @return true / false
* @note see also OCA\Encryption\Util->isEncryptedPath()
*/
public static function isEncryptedContent( $content ) {
public function preWriteEncrypt( $plainData, $key ) {
// Encrypt data to 'catfile', which includes IV
if ( $encrypted = Crypt::symmetricBlockEncryptFileContent( $plainData, $key ) ) {
if ( $encrypted = Crypt::symmetricEncryptFileContent( $plainData, $key ) ) {
// Add padding. In order to end up with data exactly 8192 bytes long we must add two letters. Something about the encryption process always results in 8190 or 8194 byte length, hence the letters must be added manually after encryption takes place. They get removed in the stream read process
// Disable the file proxies so that encryption is not automatically attempted when the file is written to disk - we are handling that separately here and we don't want to get into an infinite loop
// - Don't use a password directly as encryption key. but a key which is stored on the server and encrypted with the user password. -> password change faster
// - IMPORTANT! Check if the block lenght of the encrypted data stays the same
namespace OCA_Encryption;
namespace OCA\Encryption;
/**
* @brief Class for utilities relating to encrypted file storage system
@ -45,8 +45,8 @@ class Util {
# DONE: add method to fetch legacy key
# DONE: add method to decrypt legacy encrypted data
# DONE: fix / test the crypt stream proxy class
# DONE: replace cryptstream wrapper new AES based system
# TODO: replace cryptstream wrapper new AES based system
# TODO: add support for optional recovery user in case of lost passphrase / keys
# TODO: add admin optional required long passphrase for users
# TODO: implement flag system to allow user to specify encryption by folder, subfolder, etc.
@ -222,6 +222,18 @@ class Util {
}
/**
* @brief Check if a given path identifies an encrypted file
Sam Tuke