Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Should I trust CipherCloud's system for "homomorphic encryption" of data in the cloud? Has the security of their system been subject to peer review or other cryptanalysis? Is there any known analysis of CipherCloud's system?

share|improve this question

closed as off topic by Paŭlo Ebermann Apr 21 '13 at 17:52

Questions on Cryptography Stack Exchange are expected to relate to cryptography within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Sorry. While I can understand that you are angry about the takedown, this new question is neither on topic nor constructive. –  Paŭlo Ebermann Apr 21 '13 at 17:53
    
Why was this closed, it has fifteen upvotes so I guess it has sparked reasonable interest. Doesn't seem to be any worse than some of the other questions posted on this site(mine included);-) –  William Hird May 1 '13 at 3:12

1 Answer 1

My recommendation: No, you should not trust CipherCloud.

Justification: Yes, there has been analysis of the CipherCloud system -- some of it right here on the Cryptography StackExchange. That analysis found what appear to be severe vulnerabilities in the CipherCloud system. Unfortunately, CipherCloud has apparently sent StackExchange a DMCA takedown request, which uses the legal system to force StackExchange to take down and delete the analysis of the CipherCloud system, so I can't link to it or share with you a pointer to the details of the technical analysis. You'll just have to take my word: I read the analysis, and I found it to be pretty persuasive that their system seems to have a serious problem.

That brings me to the second, independent reason you shouldn't trust CipherCloud. Any company that responds to criticism or analysis of their product by trying to censor the criticism is out of line and is not worthy of our trust. I do not use the word "censorship" lightly, but that is exactly what CipherCloud has done. I reviewed all questions and answers on the page that was taken down, and I found nothing to make me think that the DMCA takedown request has any validity; there was nothing there that violated CipherCloud's copyright. (Not to mention that analysis of a public product for purposes of identifying defects in the product would likely have a strong case for a fair use defense.) CipherCloud is in the business of trust. Anyone who responds to criticism by trying to shut up the critic is not deserving of our trust -- plain and simple.

So, my recommendation would be: do not use CipherCloud, if security is important to you. I have outlined two independent reasons to be skeptical of the security of their system.

share|improve this answer
    
any chances they would kill this thread too ? –  sashank Apr 20 '13 at 8:57
1  
Looks like they came up with a major cryptography break-through this month: You can use AES with a random IV. True pioneers who boldly go where no man has gone before. –  CodesInChaos Oct 22 '13 at 14:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.