Mylar: A platform for building secure web applications

http://css.csail.mit.edu/mylar/

by gphilip • 12 years ago

101 23 12 years ago

css.csail.mit.edu

gphilip2• 12 years ago

From the blurb:

Mylar protects data confidentiality even when an attacker gets full access to servers. Mylar stores only encrypted data on the server, and decrypts data only in users' browsers. Simply encrypting each user's data with a user key does not suffice, and Mylar addresses three challenges in making this approach work.

First, Mylar allows the server to perform keyword search over encrypted documents, even if the documents are encrypted with different keys. Second, Mylar allows users to share keys and data securely in the presence of an active adversary. Finally, Mylar ensures that client-side application code is authentic, even if the server is malicious.

gcb0• 12 years ago

The encrypted multikey keyword search is very interesting, but using a certificate for code is troubling... Also there is almost no info on the way they use the browser xss protections on the scheme. It's only briefly mentioned.

khafra• 12 years ago

Paging tptacek; come in tptacek...

platz• 12 years ago

We need to find a way to smarten more folks up about crypto :( (myself included);

el-dawg• 12 years ago

Find a cryptoparty near you! https://en.wikipedia.org/wiki/CryptoParty

Sharma• 12 years ago

So someone builds a nice secure and useful framework/platform which is great. But why not put some effort to mention some more details or documentation about how to use it, sample, tutorials etc?

gphilip2• 12 years ago

The first paper linked from the webpage describes how to use the framework.

For a specific example, see Section 8 of the paper (Building a Mylar Application) which starts with "To demonstrate how a developer can build a Mylar application, we show the changes that we made to the kChat application to encrypt messages."

vittore2• 12 years ago

Seems if they put it in github and instead of putting everything in pdf, they would write readme.md file, they would have couple hundreds of followers

ap22213• 12 years ago

"First, Mylar allows the server to perform keyword search over encrypted documents, even if the documents are encrypted with different keys."

I thought some big tech corporation owned the patent on that.

stusmall2• 12 years ago

I would more love to read a paper on how they do it and how much information they leak through whatever indexes they form.

xyzzy123• 12 years ago

From the project page: http://eprint.iacr.org/2013/508.pdf

"Multi-Key Searchable Encryption - Raluca Ada Popa and Nickolai Zeldovich"

SkyMarshal• 12 years ago

Also of note:

* https://crypton.io/ a zero-knowledge web framework from SpiderOak

* http://hails.scs.stanford.edu/ a secure web platform framework for untrusted 3rd party plugins

jamesshamenski2• 12 years ago

It seems absolutely ridiculous that large piles of data are being stolen by small teams of hackers. If solutions like Mylar's prevent reading of the extracted data, that sounds promising. Sure, it's just another hurdle in an attack but it's something.

I wonder if we're only a few years away where technologies and practices like this become standard?

dangerlibrary• 12 years ago

Standard for what?

For 90% of web use cases, encryption like this is overkill. Serving a blog or static page does not require this level of security, and most e-commerce redirects to a handful of payments providers.

jamesshamenski2• 12 years ago

Right. If the page is public, then security isn't needed. If it's gated content then a new approach is inevitable.

justizin• 12 years ago

"I wonder if we're only a few years away where technologies and practices like this become standard?"

Businesses that store your data would likely have to stop being predicated on the ability to mine your data.

0xdeadbeefbabe• 12 years ago

Well why not go to the next level and have the attackers host your services?

kybernetikos• 12 years ago

That's not far off from what we have at the moment.

Mylar: A platform for building secure web applications

Related Stories