Crypto FAQ : What is a Zero-Knowledge Proof (or Zero-Knowledge Protocol, ZKP)?

In the context of end-to-end encryption for secure data communications and secure data storage, zero-knowledge privacy refers to specific qualities that servers must possess to ensure confidentiality while transmitting or storing client data (message, files, database entries, authentication information, cryptographic keys, file metadata). As a general principle, a zero-knowledge privacy server must never be allowed to read or write client data as plaintext (i.e., unencrypted; compare ciphertext or encrypted), including authentication information, cryptographic keys, and file metadata. Consequently, for most practical purposes, the confidentiality of the client data on the server cannot be compromised via internal mismanagement (including internal prying eyes) or external agents (e.g., cyber hackers).

The mathematical basis for ensuring zero-knowledge privacy can be traced to zero-knowledge proofs (a.k.a. “ZK proofs”), which are among one the most powerful tools cryptographers have ever devised. For an introduction to zero-knowledge proofs, see Zero Knowledge Proofs: An illustrated primer.

While many vendors of data storage claim end-to-end encryption, many fall short of zero knowledge privacy standards because they either read or write client data and authentication information as plaintext sometime during the end-to-end data transmission or storage processes, typically for client convenience. For example, consider the case of a File Synchronization & Sharing Tool user who uploads a local file on her desktop computer to her cloud-based storage server using a web-based interface. While the web-based interface may be convenient to the user, when she enters her authentication information directly into the web-based interface as plaintext she is compromising the confidentiality of the file she is uploaded, since the cloud-based server can read the unencrypted file along with the associated metadata and authentication information prior to encryption. Consequently, if the cloud-based server is compromised by either an external or internal cyber threat, any encrypted stored data is also potentially compromised.

Compare this with a bona fide zero-knowledge privacy approach, where the user utilizes a dedicated secure app to fully encrypt the file prior to uploading it to the cloud-based server using the SSL (Secure Socket Layer) protocol during transmission, and the secure app provides neither metadata nor unencrypted password information to the cloud-based server.

See Review: Secure File Sync & Sharing Tools for a comparison of the cybersecurity features of popular file synchronization and sharing tools, some of which provide zero-knowledge privacy.