Problem: Docs say little re/ privacy & handling private data #2437

ttmc · 2018-08-03T11:36:21Z

Solution:

In the root docs, add a new page titled BigchainDB, Privacy and Private Data
In the server docs, add a new page titled Production Node Security & Privacy
Other minor copy-editing

Solution: Write a new docs page about that

Solution: Create a new docs page, "Production Node Security & Privacy"

codecov-io · 2018-08-03T11:44:17Z

Codecov Report

Merging #2437 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #2437   +/-   ##
=======================================
  Coverage   88.58%   88.58%           
=======================================
  Files          40       40           
  Lines        2312     2312           
=======================================
  Hits         2048     2048           
  Misses        264      264

gautamdhameja · 2018-08-03T14:14:00Z

docs/root/source/private-data.rst

+#. Everyone with full access to a BigchainDB node (e.g. the sysadmin of a node) can read all the data stored on that node.
+#. Everyone given access to a node via the BigchainDB HTTP API can find and read all the data stored by BigchainDB. The list of people with access might be quite short.
+#. If the connection between an external user and a BigchainDB node isn’t encrypted (using HTTPS, for example), then a wiretapper can read all HTTP requests and responses in transit.
+#. If someone gets access to plaintext (regardless of where they got it), then they can (in principle) share it with the whole world. One can make it difficult for them to do that, e.g. if it is a lot of data and they only get access inside a secure room where they are searched as they leave the room.


is this needed? I guess it's implicit.

It's something that I've noticed people often raise as an issue, so I figured it would be worthwhile to mention it explicitly, lest they think we never thought about it.

gautamdhameja · 2018-08-03T14:17:00Z

docs/root/source/private-data.rst

+
+There are other ways to accomplish the same thing. The above is just one example.
+
+You might have noticed that the above example didn’t treat the “read permission” as an asset owned (controlled) by a user. The reason is that read permissions must be controlled by DocPile or a document owner, not by the user.


we can add,

... because if the permission asset is given to (transferred to or created by) the user then it cannot be controlled any further until the user transfers it back to DocPile.

gautamdhameja · 2018-08-03T14:20:20Z

docs/root/source/private-data.rst

+This setup could be used in an enterprise blockchain scenario where a special node should be able to see parts of the data, but the others should not.
+
+- The special node generates an X25519 keypair (or similar asymmetric *encryption* keypair).
+- A BigchainDB end user finds out the X25519 public key (encryption key) of the special node.


finds out can be queries. just to make it clear that the encryption public key of the node will be published by the node.

I wanted to leave it vague (how the end user finds out the key). Maybe they get it from the node via SMS, Slack or fax.

gautamdhameja · 2018-08-03T14:22:25Z

docs/root/source/private-data.rst

+
+- Ed25519 keypairs are designed for signing and verifying cryptographic signatures, `not for encrypting and decrypting messages <https://crypto.stackexchange.com/questions/27866/why-curve25519-for-encryption-but-ed25519-for-signatures>`_. For encryption, you should use keypairs designed for encryption, such as X25519.
+- If someone (or some group) publishes how to decrypt some encrypted data on-chain, then anyone with access to that encrypted data will be able to get the plaintext. The data can’t be deleted.
+- Encrypted data can’t be indexed or searched by MongoDB. (It can index and search the ciphertext, but that’s not very useful.) One might use homomorphic encryption to index and search encrypted data, but MongoDB doesn’t have any plans to support that any time soon.


We can add,

if there is indexing or keyword search needed, then some fields of the asset.data or metadata objects can be left as plain text and the sensitive information can be stored in an encrypted child-object

Good point!

ttmc added 2 commits August 3, 2018 12:58

Problem: Docs should say more about how to handle privacy & private data

f24bbc3

Solution: Write a new docs page about that

Problem: Server docs say little re/ prod. node security & privacy

509034c

Solution: Create a new docs page, "Production Node Security & Privacy"

ttmc added the docs label Aug 3, 2018

ttmc self-assigned this Aug 3, 2018

ttmc requested a review from gautamdhameja August 3, 2018 11:36

gautamdhameja reviewed Aug 3, 2018

View reviewed changes

Address initial comments from @gautamdhameja

76c852e

gautamdhameja approved these changes Aug 3, 2018

View reviewed changes

ttmc merged commit 8090a35 into bigchaindb:master Aug 6, 2018

ttmc deleted the new-docs-re-private-data branch August 6, 2018 08:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Problem: Docs say little re/ privacy & handling private data #2437

Problem: Docs say little re/ privacy & handling private data #2437

ttmc commented Aug 3, 2018

codecov-io commented Aug 3, 2018

gautamdhameja Aug 3, 2018

ttmc Aug 3, 2018

gautamdhameja Aug 3, 2018

gautamdhameja Aug 3, 2018

ttmc Aug 3, 2018

gautamdhameja Aug 3, 2018

ttmc Aug 3, 2018


		There are other ways to accomplish the same thing. The above is just one example.

		You might have noticed that the above example didn’t treat the “read permission” as an asset owned (controlled) by a user. The reason is that read permissions must be controlled by DocPile or a document owner, not by the user.

Problem: Docs say little re/ privacy & handling private data #2437

Problem: Docs say little re/ privacy & handling private data #2437

Conversation

ttmc commented Aug 3, 2018

codecov-io commented Aug 3, 2018

Codecov Report

gautamdhameja Aug 3, 2018

Choose a reason for hiding this comment

ttmc Aug 3, 2018

Choose a reason for hiding this comment

gautamdhameja Aug 3, 2018

Choose a reason for hiding this comment

gautamdhameja Aug 3, 2018

Choose a reason for hiding this comment

ttmc Aug 3, 2018

Choose a reason for hiding this comment

gautamdhameja Aug 3, 2018

Choose a reason for hiding this comment

ttmc Aug 3, 2018

Choose a reason for hiding this comment