Friday, 23 August 2013

Zero-knowledge code hosting?

Zero-knowledge code hosting?

In light of recent revelations about widespread government monitoring of
data stored by online service providers, zero-knowledge services are all
the rage now.
A zero-knowledge service is one where all data is stored encrypted with a
key that is not stored on the server. Encryption and decryption happens
entirely on the client side, and the server never sees either plaintext
data or the key. As a result, the service provider is unable to decrypt
and provide the data to a third party, even if it wanted to.
To give an example: SpiderOak can be viewed as a zero-knowledge version of
Dropbox.
As programmers, we rely heavily on, and trust some of our most sensitive
data - our code - to a particular class of online service providers: code
hosting providers (like Bitbucket, Assembla, and so on). I am of course
talking about private repositories here - the concept of zero-knowledge
does not make sense for public repositories.
My questions are:
Are there any technological barriers to creating a zero-knowledge code
hosting service? For example, is there something about the network
protocols used by popular version control systems like SVN, Mercurial, or
Git that would make it difficult (or impossible) to implement a scheme
where the data being communicated between the client and the server is
encrypted with a key the server does not know?
Are there any zero-knowledge code hosting services in existence today?

No comments:

Post a Comment