Cloud Encryption at Rest vs Client-Side Derivation: A Deep Dive
Comparing cloud provider server-side encryption (SSE-S3, SSE-KMS) with client-side key derivation: understanding who controls the master encryption keys.
Understanding Server-Side Encryption (SSE)
Virtually all major cloud providers offer 'encryption at rest' using AES-256. While this protects against physical hard drive theft in data centers, it provides zero protection against software-level compromises: the cloud provider holds the encryption keys and can decrypt files at any time.
Relying solely on cloud provider encryption means you must trust the provider, their employees, and any government entity with legal jurisdiction over them.
Key Architectural Takeaways
- Server-Side Encryption (SSE-S3) protects physical disks, but the provider holds the keys.
- Client-side key derivation ensures the server cannot decrypt files without user credentials.
- Locky combines AES-256 storage with memory-hard scrypt authentication gates.
Defense in Depth
Locky implements defense in depth: objects in Cloudflare R2 are encrypted at rest with AES-256 hardware encryption, while access to the decryption and presigned gateway requires scrypt verification using the uploader's unique salt and PIN.
Neither Cloudflare nor Locky administrators possess a master key to bypass the scrypt verification gateway.
Key Destruction on Purge
When an object reaches 24 hours or is quarantined, the file and its cryptographic metadata headers are permanently expunged. Without the salt and derived hash, reconstruction is mathematically impossible.
Try Zero-Knowledge Ephemeral Sharing
Need to share a photo or video privately without permanent digital footprint? Locky strips location metadata client-side in your browser, locks media behind a 4-digit numeric PIN, and guarantees automatic self-destruction in 24 hours.
Related Knowledge Base Guides
Zero-Knowledge Architecture: How Scrypt Key Derivation Protects Vaults
An architectural analysis of password-based key derivation (PBKDF), salted scrypt hashing (N=16384), and stateless object headers without persistent databases.
Metadata PrivacyEXIF Metadata & Geotags: What Photos Reveal About Your Location
A deep dive into Exchangeable Image File Format (EXIF) data, GPS latitude and longitude tracking, and why client-side metadata sanitization is critical before sharing photos online.