MAKING FILE ENCRYPTION FAST AND SECURE FOR TEAMS WITH ADVANCED KEY MANAGEMENT

Summary from the TLDR InfoSec newsletter

Dropbox describes how it solved for Hardware Security Module (HSM)-backed, team-based file encryption, where files are encrypted at rest and access can be removed instantly while also prioritizing usability at scale. End-to-end encryption would make it impossible for Dropbox to offer file content search, and traditional team-based key management, where a top-level key is used to derive unique keys for each file, would be prohibitively slow due to Dropbox's file storage architecture. To solve this problem, Dropbox introduced namespace encryption keys, which are derived from an HSM-backed top-level key and are used to derive team encryption keys. When sharing files, Dropbox can temporarily share the namespace encryption key while it reencrypts the blocks with team encryption keys.