End to end encrypted, if you want...
Encryption is done on your computer, your data does not hit the cloud unencrypted.
No logs except errors are being collected from cmd/server -- check it.
Your data (in its ciphered form) lives for maximum 24h in a GCS bucket.
# macOS
brew install lfaoro/tap/ion
# linux (WIP)
curl apionic.com/ion.sh | sh
# developers
go get -u github.com/lfaoro/ion
make install
ion -h
make test$ ion upload genesis.txt
13.09 MiB / 1.14 GiB [>-----------------------------] 1.12% 1.72 MiB/s 11m11s
Download from: https:/s.apionic.com/nERuG_genesis.txt
$ ion download nERuG_genesis.txt
290.19 MiB / 1.14 GiB [=======>---------------------] 24.83% 5.52 MiB/s 02m38s
Downloaded: genesis.txt
$ ion encrypt --key genesis.txt
🔑 Encryption-key: 238dFomyjB3wEejjoSUef97Y/k1gMib6XvVS56i4Apg=
🔒 Encrypted /tmp/genesis.txt
$ ion decrypt --key genesis.txt
🔑 Encryption-key: 238dFomyjB3wEejjoSUef97Y/k1gMib6XvVS56i4Apg=
🔓 Decrypted /tmp/genesis.txt$ ion lock
Password: **********
Locked .config/ion/key
$ ion unlock
Password: **********
Unlocked .config/ion/key
$ ion genesis.txt
🧮 Unable to decrypt using your local key
🔑 Decryption-key: ***********
🔓 Decrypted genesis.txt
$ ion up genesis.txt -to [email protected]
Subject: You've got data!
Body: Download your data from https://s.apionic.com/lsYuh_genesis.txt
Authenticated Encryption with Additional Authenticated Data (AEAD) couples confidentiality and integrity. Using the most popular AEAD today: AES-GCM.
The "AES-GCM" algorithm identifier is used to perform authenticated encryption and decryption using AES in Galois/Counter Mode mode, as described in NIST SP 800-38D
ref paper: https://eprint.iacr.org/2017/168.pdf
Any help, feedback and suggestions are very welcome and greatly appreciated. Start by opening an issue.
It's hard to find a service one can completely trust -- everybody claims they're encrypting your data, although how can you be sure?
I believe the only way trust what happens to your data is to see exactly the steps that lead to its manipulation, encryption & storage.
ion is F/OSS -- anyone can check how data is being encrypted and handled, spot eventual issues and fix insecurities.
Right now lsh stores the encryption keys in a key file, located in $HOME/.config/ion with 0600 permission
. Ideally we'll have the keys stored in the macOS keychain -- although I don't know if there's something comparable for
Linux and Windows.
To comply with regulators you might need to generate encryption keys using a Hardware Security Module aka HSM.
ion comes with a HSM plugin for GCP and AWS. These providers offer HSM as a service.
Configure the GCP/AWS environment variables in order to activate Cloud HSM; ref: https://.
In progress: #1
