3

I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the server. The only modules I have found which do this are CSE and Text jQuery Encode RC4 (+CCK) but they are for Drupal 6.

I need something that is user specific, so that different users can use different keys, rather than a single key or a set of keys used on the server end.

Are there any similar modules for Drupal 7?

Improve this question
6
  • Please clarify - you need to encrypt inside browser?
    – Mołot
    Commented Oct 15, 2013 at 6:42
  • The data should be stored on the server but it should be encrypted before it is sent. No further processing is to be done by the server. It should simply be stored as it is, and retrieved as it is. The purpose is to ensure that the data cannot be decoded in a server breach, except by brute force.
    – vfclists
    Commented Oct 15, 2013 at 7:05
  • Well, then my answer apply, even if it's not exactly as convenient as you probably wanted ;)
    – Mołot
    Commented Oct 15, 2013 at 7:06
  • Reverted to prevent chameleon question issue. Please ask new question if your needs are significantly different from what you originally asked.
    – Mołot
    Commented Oct 15, 2013 at 7:36
  • Related: Security of running openpgp.js in a browser with the private key in HTML5 localStorage
    – Mołot
    Commented Oct 15, 2013 at 8:02

2 Answers 2

Reset to default
4

Personally I would not trust any JavaScript or Flash provided by operator to safely hide my data from him. How can I know if data is really encrypted on my side, or is it just a smoke and mirrors? Probably that's the reason modules like that was never popular - they simply can't be trustworthy, so why to bother developing them if hardly anyone will trust them?

And if user is technological enough to know if data was encrypted on his side or not, he would prefer the other way. There is a way that allows user to be sure their data was encrypted on their side:

  1. Make user install FireGPG plugin, or something analogous for his browser, to be able to encrypt any text field with his tool, that's under his exclusive control, and developed by Open Source teams not connected to you.

  2. On Drupal side, Field Validation should stop Drupla from saving data that does not look like PGP block. Clientside Validation should stop user from posting it in the first place, but you never know for sure with client-side mechanisms.

  3. Secure Pages should mitigate the risk of accidental access to data if user will manage to send unencrypted despite clientside validation.

Improve this answer
6
  • The modules you have mentioned don't do in browser encryption. My question specifically asks for Drupal 7 equivalents of the mentioned modules
    – vfclists
    Commented Oct 15, 2013 at 7:11
  • @vfclists of course they don't, have you read first 2 paragraphs of my answer? Are they unclear? Or you simply disagree?
    – Mołot
    Commented Oct 15, 2013 at 7:13
  • Getting the user to install a browser add-on is not an option here. There is always a trade-off between perfection and ease of use and it is one I am willing to make. Your answer is a useful one but its not exactly what I want.
    – vfclists
    Commented Oct 15, 2013 at 7:23
  • @vfclists exactly as I told you in comment to your answer, I'm afraid: "not exactly as convenient as you probably wanted". If I'll think about something less inconvenient I'll post another answer, but I simply don't think there are any ready-made tools for that. Too minor "market" for such solutions.
    – Mołot
    Commented Oct 15, 2013 at 7:26
  • The questions title does not explicity ask for a module but that is what I had in mind. I will change the title to reflect the that. Sorry for the confusion
    – vfclists
    Commented Oct 15, 2013 at 7:31
2

Not at the moment. However, I'm hoping we can come together as a community and build a module that integrates Drupal with the Crypton JavaScript framework, or something similar.

There's an Encrypt module that's used by Encrypted Files and Field Encryption. I added a feature request for it to support client-side encryption. Let's see if we can work on this and track it over there.

Update (September 2017): Thanks to GSOC we now have two contrib modules that support this. See the update in https://www.drupal.org/node/2629962 (the feature request) for more information.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.