Zbox

Zbox is a zero-knowledge, privacy-focused embeddable file system. Its goal is to help application store files securely, privately and reliably. By encapsulating files and directories into an encrypted repository, it provides a virtual file system and exclusive access to authorised application.

Unlike other system-level file systems, such as ext4, XFS and Btrfs, which provide shared access to multiple processes, Zbox is a file system that runs in the same memory space as the application. It only provide access to one process at a time.

By abstracting IO access, Zbox supports a variety of underlying storage layers. Memory and OS file system are supported, RDBMS and key-value object store supports are coming soon.

Disclaimer

Zbox is under active development, we are not responsible for any data loss or leak caused by using it. Always back up your files and use at your own risk!

Features

Everything is encrypted 🔒, including metadata and directory structure, no knowledge can be leaked to underlying storage
State-of-the-art cryptography: AES-256-GCM (hardware), XChaCha20-Poly1305, Argon2 password hashing and etc., empowered by libsodium
Content-based data chunk deduplication and file-based deduplication
Data compression using LZ4 in fast mode
Data integrity is guranteed by authenticated encryption primitives (AEAD crypto)
File contents versioning
Copy-on-write (COW 🐮) semantics
ACID transactional operations
Snapshot 📷
Support multiple storages, including memory, OS file system, RDBMS (coming soon), Key-value object store (coming soon) and more
Build in Rust with ♥️

Comparison

Many OS-level file systems support encryption, such as EncFS, APFS and ZFS. Some disk encryption tools also provide virtual file system, such as TrueCrypt and VeraCrypt.

This diagram shows the differece between Zbox and them.

Below is the feature comparison list.

	Zbox	OS-level File Systems	Disk Encryption Tools
Encrypts file contents	✔️	partial	✔️
Encrypts file metadata	✔️	partial	✔️
Encrypts directory	✔️	partial	✔️
Data integrity	✔️	partial	✖️
Shared access for processes	✖️	✔️	✔️
Deduplication	✔️	✖️	✖️
Compression	✔️	partial	✖️
COW semantics	✔️	partial	✖️
ACID Transaction	✔️	✖️	✖️
Multiple storage layers	✔️	✖️	✖️
API access	✔️	through VFS	through VFS
Symbolic links	✖️	✔️	depends on inner FS
Users and permissions	✖️	✔️	✔️
FUSE support	✖️	✔️	✔️
Linux and macOS support	✔️	✔️	✔️
Windows support	✖️	partial	✔️

How to use

For reference documentation, please visit documentation.

Requirements

Rust stable >= 1.21
libsodium >= 1.0.15

Supported Platforms

64-bit Debian-based Linux, such as Ubuntu
64-bit macOS

32-bit OS and Windows are NOT supported yet.

Usage

Add the following dependency to your Cargo.toml:

[dependencies]
zbox = "~0.1"

Example

extern crate zbox;

use std::io::{Read, Write};
use zbox::{zbox_init, RepoOpener, OpenOptions};

fn main() {
    // initialise zbox environment, called first
    zbox_init();

    // create and open a repository in current OS directory
    let mut repo = RepoOpener::new()
        .create(true)
        .open("file://./my_repo", "your password")
        .unwrap();

    // create and open a file in repository for writing
    let mut file = OpenOptions::new()
        .create(true)
        .open(&mut repo, "/my_file.txt")
        .unwrap();

    // use std::io::Write trait to write data into it
    file.write_all(b"Hello, world!").unwrap();

    // finish writting to make a permanent version of content
    file.finish().unwrap();

    // read file content using std::io::Read trait
    let mut content = String::new();
    file.read_to_string(&mut content).unwrap();
    assert_eq!(content, "Hello, world!");
}

Build with Docker

Zbox comes with Docker support, it is based on rust:latest and libsodium is included. Check the Dockerfile for the details.

First, we build the Docker image which can be used to compile Zbox, run below commands from Zbox project folder.

docker build --force-rm -t zbox ./

After the Docker image is built, we can use it to build Zbox.

docker run --rm -v $PWD:/zbox zbox cargo build

Or run the test suite.

docker run --rm -v $PWD:/zbox zbox cargo test

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be licensed as above, without any additional terms of conditions.

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us.

Community

Gitter Chat Room

License

Zbox is licensed under the Apache 2.0 License - see the LICENSE file for details.

atallahade/zbox