Skip to content

Client Side Encryption

Ian Channing edited this page Nov 8, 2018 · 9 revisions

SparkleShare has the option to encrypt your files using OpenSSL's implementation of AES-256-CBC before they are being sent over to the host. This feature only works for new projects.

To use this feature, simply create an empty Git repository, but make sure it has -crypto in its name. Add the project to SparkleShare as you normally would and you'll be asked to provide a password. Alternatively you can use the dazzle-script with the following command:

sudo dazzle create-encrypted PROJECT_NAME

Make sure your password is strong, as it can can't be changed later. If you forget your password your files will be lost forever (unless scientists invent a working quantum computer and you can get one for a reasonable price).

You can also add more clients like you normally would too: you'll again be asked for the password to decrypt the files once they've been downloaded.

Please note that although file contents can't be retrieved on the server, file names can be.

Also: simultaneous edits are not merged by git since it has no access to the contents of the files. So this means that two edits in different parts of a file will always lead to conflicted versions, even when they could be merged by git (which is what happens when the repo is not encrypted).

Tutorial: Client-Side-Online-Decryption-of-Text-Files-Using-git-instaweb

Upgrading from SparkleShare v1.x to v2.x

The encryption mechanism has changed in SparkleShare v2, so if you have created an encrypted repository with the crypto extension in v1.x you will no longer be able to decrypt it in v2.x.

This means that to convert a v1.x repo you will need to have to have a decrypted version of your repository locally from v1.x and then create a new SparkleShare repo via the v2 interface (there is no longer a requirement for the crypto directory name postfix) and move all your decrypted files into the new repo.

See #1854 for more details.