Should I trust CipherCloud's system for "homomorphic encryption" of data in the cloud? Has the security of their system been subject to peer review or other cryptanalysis? Is there any known analysis of CipherCloud's system?
closed as off topic by Paŭlo Ebermann♦ Apr 21 '13 at 17:52
Questions on Cryptography Stack Exchange are expected to relate to cryptography within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.
My recommendation: No, you should not trust CipherCloud.
Justification: Yes, there has been analysis of the CipherCloud system -- some of it right here on the Cryptography StackExchange. That analysis found what appear to be severe vulnerabilities in the CipherCloud system. Unfortunately, CipherCloud has apparently sent StackExchange a DMCA takedown request, which uses the legal system to force StackExchange to take down and delete the analysis of the CipherCloud system, so I can't link to it or share with you a pointer to the details of the technical analysis. You'll just have to take my word: I read the analysis, and I found it to be pretty persuasive that their system seems to have a serious problem.
That brings me to the second, independent reason you shouldn't trust CipherCloud. Any company that responds to criticism or analysis of their product by trying to censor the criticism is out of line and is not worthy of our trust. I do not use the word "censorship" lightly, but that is exactly what CipherCloud has done. I reviewed all questions and answers on the page that was taken down, and I found nothing to make me think that the DMCA takedown request has any validity; there was nothing there that violated CipherCloud's copyright. (Not to mention that analysis of a public product for purposes of identifying defects in the product would likely have a strong case for a fair use defense.) CipherCloud is in the business of trust. Anyone who responds to criticism by trying to shut up the critic is not deserving of our trust -- plain and simple.
So, my recommendation would be: do not use CipherCloud, if security is important to you. I have outlined two independent reasons to be skeptical of the security of their system.