Encryption system using clients and untrusted servers

摘要

In one embodiment of the present invention, a first user—the creator—uses a web browser to encrypt some information. The web browser provides to the creator a URL which contains the key used for encryption, such as in the form of an anchor embedded within a URL. The web browser also provides a hash of the cryptographic key and the encrypted information to a web server. The creator transmits the URL to a second user—the viewer—who provides the URL to a web browser, thereby causing the web browser to navigate to a decryption web page maintained by the web server, but without transmitting the cryptographic key to the web server. The viewer's web browser hashes the cryptographic key and sends the hash to the web server, which uses the hash to identify and return the encrypted information to the viewer's web browser, which in turn uses the encryption key to decrypt the message and display the decrypted message to the viewer.

主权项

1. A method comprising:
receiving, by a first computing device, an unencrypted asset; encrypting the unencrypted asset with an encryption key by the first computing device to create an encrypted asset; transmitting the encrypted asset and a first hash of the encryption key from the first computing device to an untrusted server via the Internet, wherein the first hash of the encryption key identifies the encrypted asset at the untrusted server; generating a uniform resource identifier by the first computing device, the uniform resource identifier including the encryption key and identifying the untrusted server as storing the encrypted asset; transmitting the uniform resource identifier including the encryption key to a second computing device, thereby allowing the second computing device to access the encrypted asset by providing the untrusted server identified in the uniform resource identifier with a second hash of the encryption key to access the encrypted asset without providing the untrusted server with an unhashed version of the encryption key or the unencrypted asset, wherein the encryption key is included in the uniform resource identifier as an anchor, thereby causing the second computing device to exclude the anchor from a request to access the encrypted asset made to the untrusted server by the second computing device.