Grendel: free/open source software for protecting your cloud data

Marc Hedlund sez, "Wesabe just open sourced a project called Grendel that makes it easy for web apps to encrypt data using the user's login password, and only decrypt that data when the user is logged in. Let's say you're using a word processing web app and don't want your documents stored plaintext -- the web app could use Grendel to easily encrypt your docs for you, using OpenPGP. Log in and you can edit; log out and only you can get at the data again (since only you have your password). There are some hooks for encrypting with multiple keys if you want to share docs with selected other users on the system. Since people are throwing a ton of sensitive data in web apps these days I think having some tools to help make that safer would be a good thing."

Of course, data on web sites is usually shared with at least some other people in some way. Sometimes a user might want to share their information with the web site support staff, so the staff can help solve a problem or fix a bug. Or, the user might want to share their sensitive data with selected other users on the site, such as coworkers or family members. Grendel allows this, letting you encrypt data with multiple keys so that more than one user's password can gain access.

It's very easy to screw up when building a cryptography system -- check out Nate Lawson's excellent Google Tech Talk on common crypto flaws, or Matasano's Socratic dialog on similar topics, for a map of the pitfalls available to you, and us. We've been fortunate at Wesabe to have a number of people who think very carefully about security, and they've put a lot of effort into designing and building Grendel. That said, we have two goals in open sourcing Grendel: first, to make a tool available to others that could help make "cloud" applications in general much safer for everyone, and second, to open up what we've built so others can review and help us improve it. We would love comments on any aspect of Grendel, security or otherwise.

Protecting "Cloud" Secrets with Grendel (Thanks, Marc!)

(Disclosure: I am proud to serve on Wesabe's advisory board)

• [Anonymous]

  What device are those rotors from?

• [nixiebunny]

  I love rotors, Enigma or others.

  I’m leery of cloud computing just because your data are in the hands of someone else whose main goal in life is not to protect *your* data.

  Encryption is better than no encryption. Unless you forget the key, that is.

  I don’t think it needs more than a cursory attempt at encryption, since it’s not likely that folks with truly sensitive data would store it in a cloud.

  • [Inventorjack]

    “I don’t think it needs more than a cursory attempt at encryption, since it’s not likely that folks with truly sensitive data would store it in a cloud.”

    What alternate world are you living on?

    Just kidding with you, but do consider: If government, military, and businesses put very sensitive data on laptops and flash drives which are then lost, what gives you any indication that some people wouldn’t do the same with the cloud? I’m pretty confident that there’s at least *some* very sensitive data on just about any service in the cloud.

• [Anonymous]

  Steampunk cryptex ? ;-)

• [hep cat]

  If this is supposed to be be useful for cloud computing, they better work out the Beowulf incompatibilities. I hear that Grendel dies in a Beowulf environment.

• [cymk]

  From the sounds of it, the system is only as good as the password. If the user has a really simple password phrase or number string then all the encryption in the world won’t help. For example, a few weeks back, twitter posted a list of 100+ banned passwords because they were too damned easy to guess.

  I think “cloud computing” will gain a larger foot hold, as our devices get smaller and smaller, and the ability to log on to a data cloud or server containing anything and everything you could want would become invaluable. Instead of having 32 GB on your ipod or mp3 player, you connect wirelessly to your data cloud and select from any music file you have stored (TB or PB worth of data). No more having to worry about breaking or corrupting HDDs or SSDs, all your data would be stored and backed up in your own data cloud.