docs/src/encryption.md@bacb54502b24
docs/src/encryption.md
Thu, 21 Dec 2017 19:48:27 +0100
- author
- Mike Becker <universe@uap-core.de>
- date
- Thu, 21 Dec 2017 19:48:27 +0100
- changeset 359
- bacb54502b24
- parent 283
- 0e36bb75a732
- permissions
- -rw-r--r--
davql: allow ANYWHERE keyword in SELECT statements
This may seem pointless, but users might want to be explicit about this and the grammar is more consistent.
This commit also adds some no-ops to the functions body of the SET parser, because some day the grammar might allow more clauses after the WHERE clause.
--- title: 'Encryption' --- The davutils programs have an integrated client-side encryption feature, that allows you to encrypt and decrypt on the fly with AES256 or AES128. To use this feature, the server **must** support WebDAV dead properties. The tools support both, encryption of the resource content and encryption of the resource name. Each resource is encrypted separately. With activated name encryption, the actual resource name is disguised by a random name but the name used by the client is stored encrypted as a WebDAV property. This means, an attacker can see the directory structure and the file length, but can't guess the file names and in particular which files have the same name. To enable encryption a key must be configured in `$HOME/.dav/config.xml`. A key must have a unique name. To access encrypted resources, all clients must configure the same key with the same name. Currently a key can only be loaded from a file and not generated from a password. A configuration for a key looks like: <key> <name>mykey1</name> <file>keys/mykey1</file> </key> The file path must be relative to `$HOME/.dav/`. In this example the file `$HOME/.dav/keys/mykey1` is loaded. To generate a key use **`dd`** on unix like systems. The following command generates a 256 bit (32 bytes) key for AES256 encryption. dd if=/dev/random of=mykey1 bs=32 count=1 After a key is configured, you can enable encryption/decryption in two ways. You can use the dav option **`-c`** to enable encryption and specify your key with the **`-k`** option. The alternative is to enable encryption by default for a repository in the config.xml file. You may also choose to specify the default key only and use **`-c`** where you like to use encryption. <repository> <name>myrepo</name> <url>http://example.com/webdav/</url> <default-key>mykey1</default-key> <full-encryption>true</full-encryption> </repository> See [Configuration][1] for details. [1]: ./configuration.html Internals --------- When a resource is encrypted, some crypto properties (namespace: http://davutils.org/) are set for the resource. - crypto-key: Contains the name of the key used for encryption. The presence of this property indicates that the resource is encrypted - crypto-hash: A hash of the cleartext, encrypted and base64 encoded - crypto-name: The name of the resource, encrypted and base64 encoded. This property is not used if name encryption is disabled.
