I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the server. The only modules I have found which do this are CSE and Text jQuery Encode RC4 (+CCK) but they are for Drupal 6.

I need something that is user specific, so that different users can use different keys, rather than a single key or a set of keys used on the server end.

Are there any similar modules for Drupal 7?

  • Please clarify - you need to encrypt inside browser? – Mołot Oct 15 '13 at 6:42
  • The data should be stored on the server but it should be encrypted before it is sent. No further processing is to be done by the server. It should simply be stored as it is, and retrieved as it is. The purpose is to ensure that the data cannot be decoded in a server breach, except by brute force. – vfclists Oct 15 '13 at 7:05
  • Well, then my answer apply, even if it's not exactly as convenient as you probably wanted ;) – Mołot Oct 15 '13 at 7:06
  • Reverted to prevent chameleon question issue. Please ask new question if your needs are significantly different from what you originally asked. – Mołot Oct 15 '13 at 7:36

Personally I would not trust any JavaScript or Flash provided by operator to safely hide my data from him. How can I know if data is really encrypted on my side, or is it just a smoke and mirrors? Probably that's the reason modules like that was never popular - they simply can't be trustworthy, so why to bother developing them if hardly anyone will trust them?

And if user is technological enough to know if data was encrypted on his side or not, he would prefer the other way. There is a way that allows user to be sure their data was encrypted on their side:

  1. Make user install FireGPG plugin, or something analogous for his browser, to be able to encrypt any text field with his tool, that's under his exclusive control, and developed by Open Source teams not connected to you.

  2. On Drupal side, Field Validation should stop Drupla from saving data that does not look like PGP block. Clientside Validation should stop user from posting it in the first place, but you never know for sure with client-side mechanisms.

  3. Secure Pages should mitigate the risk of accidental access to data if user will manage to send unencrypted despite clientside validation.

  • The modules you have mentioned don't do in browser encryption. My question specifically asks for Drupal 7 equivalents of the mentioned modules – vfclists Oct 15 '13 at 7:11
  • @vfclists of course they don't, have you read first 2 paragraphs of my answer? Are they unclear? Or you simply disagree? – Mołot Oct 15 '13 at 7:13
  • Getting the user to install a browser add-on is not an option here. There is always a trade-off between perfection and ease of use and it is one I am willing to make. Your answer is a useful one but its not exactly what I want. – vfclists Oct 15 '13 at 7:23
  • @vfclists exactly as I told you in comment to your answer, I'm afraid: "not exactly as convenient as you probably wanted". If I'll think about something less inconvenient I'll post another answer, but I simply don't think there are any ready-made tools for that. Too minor "market" for such solutions. – Mołot Oct 15 '13 at 7:26
  • The questions title does not explicity ask for a module but that is what I had in mind. I will change the title to reflect the that. Sorry for the confusion – vfclists Oct 15 '13 at 7:31

Not at the moment. However, I'm hoping we can come together as a community and build a module that integrates Drupal with the Crypton JavaScript framework, or something similar.

There's an Encrypt module that's used by Encrypted Files and Field Encryption. I added a feature request for it to support client-side encryption. Let's see if we can work on this and track it over there.

Update (September 2017): Thanks to GSOC we now have two contrib modules that support this. See the update in https://www.drupal.org/node/2629962 (the feature request) for more information.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.