If I have an encrypted file in IPFS with a symmetric key that I share, can I after that decrypt and re-encrypt that file with a different key in order to revoke access?
-
It depends on the possibility of replacing a file in an IPFS network. I personally don't think that is possible.– Kaki Master Of TimeJun 27, 2018 at 11:44
Add a comment
|
3 Answers
If I understand what you are trying to do, probably, no. Couple pieces of information for the answer
- IPFS uses content addressing.
- Currently, IPFS doesn't have any concern for encrypted, not encrypted, variety of encryption. It just knows the bytes of the file, the content.
So, if you encrypt a file and put it on IPFS, it will get an address based on the encrypted result. If you later, decrypt that file, encrypt it anew, and put the result back on IPFS, IPFS will have totally new content and therefor the content will have a totally new address.
Yes, you can do it. But no, you can't use the same address (the hash) again.
-
ok, I understand, but the original file still will be there, and someone with the first address and the old key would can decrypt it? Because I understand in IPFS we can't delete or modify anything, right?– joelJun 28, 2018 at 3:42
-
That's correct. Once it's in IPFS you can never know if it will be deleted. In fact, the whole point of IPFS is to guarantee such permanency, so I'm not sure IPFS is really what you want to use. See my answer. Jul 4, 2018 at 18:36
As andrewxhill says, IPFS is immutable and content-addressed, which means if you publish new content it will get a new address, and the original content will stay there.
You could use IPNS, which is an approach to introduce mutability to IPFS: same hash, evolving content. The basic idea is that you use a private key that works as a publishing key. This way, you could change the encrypted content while maintaining the same hash.
However, do keep in mind a few things:
- On any digital network, once a content has been published, it's very hard to remove access, because anyone may have copied it somewhere. I think your best bet is to prevent access to future versions of content rather than removing access to already published content. At any rate, removing access might be valid as a business process, but it's not reliable from a security perspective.
- More importantly: if you want to be able to control and limit propagation of some content, I would challenge the choice of IPFS in the first place, as IPFS is precisely about providing redundant access and high availability.
If you're still convinced that you need IPFS, consider using the IPFS forum, as this is not really an Ethereum question (at least based on the information you shared so far).
I would also like to note that this question sounds like a case of XY problem. Maybe try to explain what the actual problem is that you want to solve.
No you can't decrypt and encrypt a file on IPFS to revoke access.
Re-encrypting the file will give you a new content based identifier (CID) because the contents are now different.
Every file that goes through each IPFS gateways becomes cached, so as long as a single IPFS node still has the file then someone can still request it based on the CID. IPFS is in a way a global decentralized CDN.
