What is zero-access encryption and why it is important for security

zero access encryption

Some of your most sensitive data sit on the cloud, on the servers of Internet service providers. Zero-access encryption gives you control over your data online.

Most of us would not give our private, personal information to strangers and then trust them not to leak it. But that’s essentially what we do every time we store chat histories, email, documents, and pictures on the cloud. When you save a document to Google Drive, a photo album to iCloud, or an intimate conversation to Facebook Messenger, you are trusting that this information will not be breached or misused.

There are ways, however, to encrypt your data so that only you can access it, and zero-access encryption is one of these methods. Zero-access encryption is a way of protecting data at rest — that is, while the information is sitting in storage on the cloud. With this type of encryption, even if hackers were to breach the provider’s servers and steal your files, they would not be able to decrypt the data. Zero-access encryption ensures that only you, the data owner, have the technical ability to read your data.

How does zero-access encryption work?

Zero-access encryption is just what it sounds like: a type of encryption for data at rest that renders digital files inaccessible to the service provider. The files can only be decrypted using the user’s private encryption key. Because the server does not have access to the user’s private encryption key, once the files are encrypted with the user’s public encryption key they are no longer accessible to the server or the server’s owner. When the data owner wants to view their data, they request the encrypted files from the server and decrypt them locally on their device, not on the server.

How is zero-access encryption different from end-to-end encryption?

At ProtonMail, we use both zero-access encryption and end-to-end encryption to protect your data. To understand the difference, consider two scenarios:

1. Someone using a Gmail account sends an email to a ProtonMail account. When it arrives at ProtonMail, our servers can read that email because Gmail does not support end-to-end encryption. However, after receiving the email, we encrypt it immediately using the ProtonMail account owner’s public encryption key. Afterwards, we are no longer able to decrypt the message. In fact, the message can now only be decrypted by the ProtonMail account owner. This is zero-access encryption.

1. Someone using a ProtonMail account sends an email to another ProtonMail email address. The email is encrypted on the sender’s device using the public encryption key of the recipient before being transferred to the ProtonMail server and to the recipient. Thus, the message is already encrypted before it reaches our server, and only the sender and the recipient have the ability to decrypt the email. This is end-to-end encryption.

As you can see from these examples, end-to-end encryption is the stronger of these two types of encryption because ProtonMail never sees the unencrypted message. Zero-access encryption does prevent the messages in your mailbox from being shared with third parties or leaked in the event of a data breach, but those messages are accessible to ProtonMail servers for a split second before the message is encrypted. For these reasons, we generally recommend that for highly sensitive conversations, both parties use ProtonMail to take advantage of the stronger end-to-end encryption.

Zero-access encryption solves big security problems

Most companies do not implement zero-access encryption either because they sell your private information to advertisers (Google, Facebook, etc.) or because the technical challenges of implementing it are too great.

Instead, they might use regular encryption where they retain control over the encryption keys. This is like storing the key to the lock with the lock itself and creates many vulnerabilities. For example, if servers are ever hacked, your private conversations can be leaked (like in the Yahoo! breach of all 3 billion of its accounts).

Furthermore, this approach also leaves data open for misuse, either by rogue employees or unscrupulous third parties, such as in the Cambridge Analytica/Facebook scandal. This data can also be made accessible to government surveillance agencies or sold outright to advertisers.

We drastically reduce these security and privacy vulnerabilities by using zero-access encryption to ensure that we ourselves do not have access to your data. That way, even if somehow ProtonMail servers are breached, the contents of users’ emails will still be encrypted. Both zero-access encryption and end-to-end encryption are essential to ensure good protection against data breaches and privacy violations in the digital age, and for this reason, they are highly recommended by experts and important for complying with data protection laws such as the GDPR law.

Best Regards,
The ProtonMail Team

 

You can get a free secure email account from ProtonMail here.

We also provide a free VPN service to protect your privacy.

ProtonMail and ProtonVPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan or donate. Thank you for your support!

About the Author

Ben Wolford

A journalist by training, Ben has reported and covered stories around the world. In 2014, he founded a magazine, Latterly, devoted to international reporting on human rights. He joined ProtonMail to help lead the fight for data privacy.

 

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

9 comments on “What is zero-access encryption and why it is important for security

  • What happens in the case where I send an email from ProtonMail (which is encrypted) to someone who has a Gmail account? How are they able to read my email?

    Reply
  • Thanks, Irina. In the post, it describes how zero-access encryption can help protect our data that we might want to store on a cloud. But I don’t know how to do that. How might I encrypt my photos that I’d like Amazon Prime Photos to store? Or how do I encrypt files that I want to store on Google Drive. I like these clouds services because they can provide an offsite back-up. But the blog describes very well why for privacy concerns it would be worth encrypting it before Google or Amazon can see my personal stuff

    Reply
    • Hi, Joy! The zero-access encryption refers to the way ProtonMail stores data on our servers. We cannot control how you store your private data on Google or Amazon because we do not own those servers. This type of encryption happens automatically on ProtonMail when you use our service to send or receive emails.

      Reply
  • In describing email sent between ProtonMail accounts, you say “The email is encrypted on the sender’s device using the public encryption key of the recipient before being transferred to the ProtonMail server and to the recipient. Thus, the message is already encrypted before it reaches our server, and only the sender and the recipient have the ability to decrypt the email.” Does the sender really have the ability to decrypt a message encrypted with someone else’s public key? I thought, once encrypted, only the reciepient can decrypt the message. If I don’t save a plaintext copy, I can’t get to it anymore.

    Reply