How ownCloud Uses Encryption to Protect Your Data
Because ownCloud is all about protecting your privacy we often get questions about encryption of data. How and where does ownCloud use encryption? How does it help to keep your data safe?
Edit 2019-05-09: This article is a bit outdated. If you want to know more about ownCloud’s current approach towards file encryption, take a look at this Whitepaper.
What is Encryption
Encryption is the ‘mashing up’ (encoding) of data in a way that makes it nearly impossible for somebody else to read (decrypt) it without a specific piece of knowledge: the encryption key. A simple example would be to move each character in the text one further in the alphabet, so an A becomes a B, a K becomes an L and so on. This makes the text unreadable, unless you know the trick: just move them all back one character!
Of course, modern encryption techniques are far more complicated, using advanced mathematics to make it virtually impossible to recover the data without the key. You can read more in the wikipedia entry.
How Does ownCloud Use Encryption?
ownCloud uses encryption in two major ways: when transferring data to and from the server; and when storing data on an external server. The first requires the use of ‘TLS‘, a secure communication protocol for the internet. The ownCloud installation manual contains instructions for enabling TLS encryption and it is highly recommended to do this.
For storing data encrypted on ownCloud, you need to have the ownCloud Encryption app enabled. It will then encrypt all your data with a strong, randomly generated key, which is then protected with your log-in password. You can find documentation here. As the manual states:
“Encryption and decryption always occurs on the server side. This enables you to continue to use all other apps to view and edit data. However, this method of encryption also means that the server administrator can intercept your data.”
What this means is that you (your ownCloud server) keeps the key to decrypt your data. This makes it possible to access your files over the web interface and share files with others. To run safely on a non-trusted server, data would have to be encrypted by the client (your computer, phone or other devices) before being sent to the non-trusted ownCloud server and you would lose the web interface access.
The Encryption App
The goal of the Encryption app is to protect data on external storage. All files sent there will be encrypted by the ownCloud server, and upon retrieval, decrypted before serving them to you (or those you shared them with).
The key to decrypt the data never leaves the ownCloud server. This makes the ownCloud Encryption app a great tool to benefit from cloud storage offered by services like Dropbox or Google Drive while ensuring security and privacy of your data!
Using the Encryption app is very simple. Just enable the app and the first time you log in again it will start to encrypt your data. If you later decide to disable the Encryption app, it will provide the option to decrypt your files in your personal settings.
Please note that you should be very careful not to lose your login password as you will lose access to your files. As admin you can set a recovery password. See the documentation for more details.
Keep in mind that the Encryption app only encrypts the content of your files. Filename and folder structures are not protected. You can read more technical details on the Encryption app in this blog post.
Other technologies to protect your data
Application-specific encryption like the ownCloud encryption app without external storage makes little sense considering that you can just encrypt the whole hard drive. Several technologies exist which can encrypt your hard drive or create an encrypted, protected file where you can securely store data.
We would recommend dm-crypt on Linux, as well as eCryptfs and EncFs for individual file and folder encryption. Windows users could use BitLocker and Mac users could try FileVault.
One should note that you can also use full-disk encryption without physical access, with dropbear and busybox you can setup a system that you can unlock via SSH.
On the server, hard drive encryption on the operating system level would secure your server from somebody who gets physical access to it and steals the disks. Note that this only secures your data when the system is turned off, not while it is running!
Full-Disk Encryption not only gives better security, it also offers far better performance (especially thanks to modern extensions in CPU’s like AES-NI).
Implications for Security
ownCloud uses encryption to protect your data when it is not on the ownCloud client or the server. However, it does not encrypt data on your computer or protect you if access to your ownCloud server itself is compromised! There are other widely available technologies which provide protection of your data against different risks.
The ownCloud Encryption app provides a great way to secure your data on untrusted cloud storage services. It is easy to enable and works entirely unnoticeable for the user.
UPDATE: Encryption 2.0, introduced in ownCloud 8.1, makes encryption more flexible and modular.