Tahoe: the least-authority filesystem

ABSTRACT

Tahoe is a system for secure, distributed storage. It uses capabilities for access control, cryptography for confidentiality and integrity, and erasure coding for fault-tolerance. It has been deployed in a commercial backup service and is currently operational. The implementation is Open Source.

REFERENCES

• 1: allmydata.org web site, 2007.
• 2: R. Anderson. `trusted computing' frequently asked questions, 2003. {Online; accessed 26-May-2008}.
• 3: John Black , Phillip Rogaway , Thomas Shrimpton, Encryption-Scheme Security in the Presence of Key-Dependent Messages, Revised Papers from the 9th Annual International Workshop on Selected Areas in Cryptography, p.62-75, August 15-16, 2002
• 4: D. R. L. Brown. One-up problem for (ec)dsa. Cryptology ePrint Archive, Report 2008/286, 2008.
• 5: John W. Byers , Michael Luby , Michael Mitzenmacher , Ashutosh Rege, A digital fountain approach to reliable distribution of bulk data, ACM SIGCOMM Computer Communication Review, v.28 n.4, p.56-67, Oct. 1998
• 6: Jack B. Dennis , Earl C. Van Horn, Programming semantics for multiprogrammed computations, Communications of the ACM, v.26 n.1, p.29-35, Jan. 1983 [doi>10.1145/357980.357993]
• 7: John R. Douceur , Atul Adya , William J. Bolosky , Dan Simon , Marvin Theimer, Reclaiming Space from Duplicate Files in a Serverless Distributed File System, Proceedings of the 22 nd International Conference on Distributed Computing Systems (ICDCS'02), p.617, July 02-05, 2002
• 8: Niels Ferguson , Bruce Schneier, Practical Cryptography, John Wiley & Sons, Inc., New York, NY, 2003
• 9: G. R. Goodson, J. J. Wylie, G. R. Ganger, and M. K. Reiter. Efficient byzantine-tolerant erasure-coded storage. pages 135--144, 2004.
• 10: C. Grothoff. Crisp advisory 2008--01: Uris do not refer to unique files in allmydata tahoe, July 2008.
• 11: I. Haitner and T. Holenstein. On the (im)possibility of key dependent encryption. Cryptology ePrint Archive, Report 2008/164, 2008.
• 12: S. Halevi and H. Krawczyk. Security under key-dependent inputs, 2007.
• 13: Norman Hardy, KeyKOS architecture, ACM SIGOPS Operating Systems Review, v.19 n.4, p.8-25, October 1985 [doi>10.1145/858336.858337]
• 14: Ari Juels , Burton S. Kaliski, Jr., Pors: proofs of retrievability for large files, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315317]
• 15: John Kelsey , Bruce Schneier , David Wagner, Protocol Interactions and the Chosen Protocol Attack, Proceedings of the 5th International Workshop on Security Protocols, p.91-104, April 07-09, 1997
• 16: A. Lenstra. Handbook of Information Security, chapter Key Lengths. Wiley, 2004.
• 17: J. Li and D. Mazièeres. Beyond one-third faulty replicas in byzantine fault tolerant systems. In NSDI. USENIX, 2007.
• 18: H. Lipmaa, P. Rogaway, and D. Wagner. Comments to NIST concerning AES-modes of operations: CTR-mode encryption. In Symmetric Key Block Cipher Modes of Operation Workshop, Baltimore, Maryland, USA, 2000.
• 19: Alfred J. Menezes , Scott A. Vanstone , Paul C. Van Oorschot, Handbook of Applied Cryptography, CRC Press, Inc., Boca Raton, FL, 1996
• 20: Ralph C. Merkle, A Digital Signature Based on a Conventional Encryption Function, A Conference on the Theory and Applications of Cryptographic Techniques on Advances in Cryptology, p.369-378, August 16-20, 1987
• 21: Mark Samuel Miller , Jonathan S. Shapiro, Robust composition: towards a unified approach to access control and concurrency control, Johns Hopkins University, Baltimore, MD, 2006
• 22: M. S. Miller, K. P. Yee, and J. Shapiro. Capability myths demolished. Technical report, Combex, Inc., 2003.
• 23: Martín Abadi , Roger Needham, Prudent Engineering Practice for Cryptographic Protocols, IEEE Transactions on Software Engineering, v.22 n.1, p.6-15, January 1996 [doi>10.1109/32.481513]
• 24: CORPORATE NIST, The digital signature standard, Communications of the ACM, v.35 n.7, p.36-40, July 1992 [doi>10.1145/129902.129904]
• 25: J. S. Plank, L. Xu, J. Luo, C. D. Schuman, and Z. Wilcox-O'Hearn. A performance evaluation and examination of open-source erasure coding libraries for storage. 2009.
• 26: B. Preneel and P. C. V. Oorschot. Mdx-mac and building fast macs from hash functions. pages 1--14. Springer-Verlag, 1995.
• 27: R. L. Rivest, A. Shamir, and L. M. Adelman. A method for obtaining digital signatures and public-key cryptosystems. Technical Report MIT/LCS/TM-82, MIT, 1977.
• 28: L. Rizzo. the feasibility of software fec. Technical Report LR-970131, DEIT, 1997.
• 29: Wikipedia. Hushmail | Wikipedia, the free encyclopedia, 2008. {Online; accessed 26-May-2008}.
• 30: Z. Wilcox-O'Hearn. convergent encryption reconsidered, 2008. {Online; accessed 18-Aug-2008}.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  E. Data
  E.3 DATA ENCRYPTION
      Subjects: Public key cryptosystems
  E.4 CODING AND INFORMATION THEORY
      Subjects: Error control codes

  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL

General Terms:
Design, Human Factors, Reliability, Security

Keywords:
capabilities, fault-tolerance, open source, peer-to-peer