End-to-End Encryption

Note

End-to-end encryption is an Enterprise-only feature. Community deployments can use server-side encryption (SSE) as an alternative.

FlexFS Enterprise supports end-to-end (E2E) encryption where data is encrypted on the mount client before it leaves the machine. Neither the metadata server, proxy servers, nor the cloud object storage provider can read the plaintext data.

How it works

1. Volume creation — encryption is enabled on the volume at creation time (via configure.flexfs or the CSI StorageClass encryption: "true" parameter).
2. First mount — the user provides an encryption secret (passphrase). FlexFS derives cryptographic keys from this secret and registers a secret ID with the admin server.
3. Subsequent mounts — the user provides the same encryption secret. FlexFS re-derives the keys and verifies the result matches the stored secret ID.

The encryption secret never leaves the mount client’s memory. The admin server stores only the secret ID, never the secret or the encryption key itself.

Key derivation

FlexFS uses Argon2id to derive the AES-256 encryption key from the user’s encryption secret. It also registers a secret ID — a salted hash derived from your secret — with the admin server, which later mounts use to verify that the correct secret was supplied.

What is encrypted

Data	Encryption	Cipher
File content blocks	AES-256-GCM	Applied before upload to object storage; each block is cryptographically bound to its location so blocks cannot be swapped
Metadata fields	AES-256-GCM	Encrypted on the mount client before sending to the metadata server

Both block data and metadata are encrypted client-side, ensuring true end-to-end encryption.

Encryption secret requirements

• Minimum length: 8 characters
• All mounts of the same volume must use the same encryption secret
• The secret can be provided interactively (prompted at mount time) or via the credentials file (secret field)

Caution

Losing the encryption secret results in permanently unreadable data. There is no recovery mechanism — neither Paradigm4 nor your cloud provider can decrypt the data without the original secret.

Setting up encryption

During volume creation

Using configure.flexfs:

create volume --name <volume-name> --metaStoreID 1 --blockStoreID 1 --encryption

Using the CSI driver StorageClass:

parameters:
  encryption: "true"

First mount

On the first mount of an encrypted volume, you will be prompted for the encryption secret:

*********************
End-to-end encryption
*********************
This volume's settings specify that end-to-end encryption be used, but
an encryption secret has not yet been provided. Let's set one up now.

Notes:
  * Your encryption secret never leaves the memory of this client.
  * Be sure to store your encryption secret safely and securely.
  * You must provide the same encryption secret for all mounts.
  * Losing your encryption secret will result in unreadable data.

Volume secret:

Alternatively, provide the secret in the credentials file:

adminAddr = "admin.example.com:443"
token = "<volume-token>"
secret = "<secret>"

Subsequent mounts

On subsequent mounts, you will be prompted:

*********************
End-to-end encryption
*********************
This volume is configured to use end-to-end encryption.
Please provide the matching encryption secret below.

Volume secret:

If the provided secret does not match the registered secret ID, the mount will fail with:

Error: incorrect volume secret

Combining with server-side encryption

E2E encryption and server-side encryption (SSE) can be used simultaneously. In this case, data is first encrypted client-side by flexFS (AES-256), then encrypted again server-side by the object storage provider (SSE). This provides defense in depth.

Next steps

• Server-side encryption — S3 SSE via --sse
• Authentication — token model
• Access Control — POSIX permissions and ACLs