A source of common confusion is the difference between encryption and access control, and what the AxCrypt 2 Sign In is about.

Access Control

Access control is when a given identity is given permissions by a higher authority (is authorized) to perform actions such as reading a file.

For access control to work, we need authentication to ensure that the identity claim is actually authentic. Simply put – that I am who I claim to be. We also need someone to perform that authentication – typically an operating system or a server.

When you limit access to a file using access control, such as when you store a file on a network server or in your cloud storage, it’s the responsibility of the operating system or cloud storage server to ask you for credentials (like a password) to prove who you are, and then to enforce the restrictions that you have set on your files. The authentication can be made stronger by for example 2 factor authentication.

But it’s still a piece of software essentially asking you for proof of your claimed identity, and then based on that making decisions on what you can or can’t do with the files. Anyone with administrator access can always bypass these rules, since that’s what being an administrator means! Also, anyone with back-channel access to the data, such as a database backup, can access the data without being an administrator by using software that does not honor any access control to read the file.

Encryption

Encryption  does not care about who you are.  Decryption just either works or does not work, depending on if the right cryptographic key is provided to the decryption software.

There is no software enforcing the security, the data is transformed with encryption into a form that reveals nothing about the real contents. To reverse the transformation, to decrypt it, the correct cryptographic key is required. If the wrong key is provided, the decryption software can only fail. There’s no bypassing by being an administrator or accessing the data via back-channels.

This also means that contrary to access control, anyone who holds the correct key can decrypt the data. It does not matter who you are or claim to be. If you have the key, you can decrypt.

That’s why the decryption key must be kept secret. That’s also why the encrypted content is irretrievably lost, if the decryption key is lost.

AxCrypt is an encryption software. It encrypts files. It does not authenticate users in order to ‘allow’ contents to be viewed.

AxCrypt 2 Sign In

If AxCrypt works by encryption, why does AxCrypt 2 ask you to sign in?

We decided to use “sign in” as the metaphor for normal usage, because what happens is very similar, and most of us are used to “signing in”. What really happens is that we don’t authenticate the identity as such (your e-mail), but we do ensure that the password provided is correct and associated with the e-mail. There’s a subtle difference. AxCrypt uses the verified password to encrypt and decrypt. Access control systems uses the authenticated identity to match against permissions.

This also means, that if two users actually have the same password, they will be able to decrypt each others files. That’s another reason to chose a really long, good and strong password so that this risk is reduced to effective zero.

One of the reasons we verify the password at all for encryption is to reduce the risk of you mistyping the password when encrypting files, which unfortunately happens all too frequently with AxCrypt 1. Even with the requirement to type it twice.

This AxCrypt sign in metahpor thus provides us with real benefits, we only have to enter it once per session and new files will be guaranteed to be encrypted with the password we actually intended to use – and which is verified to be the one we used the last time, i.e. the correct one.

Happy AxCrypting!

Svante, Developer and Co-Founder AxCrypt AB.