Keybase's entire purpose is to make a public database of people. They know who you are, therefore, they have some knowledge.
Not that complicated. If you store user profile data and therefore link the data they store to that profile, it is not zero knowledge.
Arguably, if you have to charge money for a service, you might need a way to do that, but then you're not zero knowledge. Or you just a flat rate with unlimited of whatever your service provides.
I don't think it makes a lot of sense to trust a company that claims to be secure when they don't understand even the terminology, let along the complexities, of providing security and privacy.
Spider Oak has also dropped the term and now goes with "no knowledge."
If the system can work with Victor knowing anything else about Peggy, e.g., entirely taking the question "who are you" out of the equation, well, then, we've got an interesting situation.
Unless the anonymity set is very small or bandwidth is infinite, accomplishing metadata privacy requires some kind of zero knowledge proof.
I don't think such systems necessarily require E2E encryption. If the term zero knowledge continues to be misused, it's going to cause more confusion later when services get around to protecting metadata.
A phrase like "military grade" is now and was always a meaningless, nonsense phrase used to suggest robustness. No military has actually defined any "grade" of encryption to measure with. It's like saying that your ladies deodorant is "Strong Enough For a Man". Sure, whatever.
End to end encryption (E2E) on the other hand means something specific: The secrets critical to the security of the system live on the end user devices. If a standard webmail service claims to be E2E, it's not marketing, it's lying.
Likewise, zero knowledge has a well defined meaning. It's a protocol where a Prover convinces a Verifier that it has some information, without actually revealing what that information is. For example, Peggy could have a set of public keys, whose order she has randomly shuffled. She can prove to Victor that the output of her Shuffle is a valid permutation of the keys, without revealing to Victor what order they were in before she shuffled them.
Zero knowledge protocols are useful building blocks for such tasks as:
- Mixing messages in a way that prevents a global passive adversary who also maliciously runs some of the routers in a network from learning the social graph of users (Tor cannot do this, because it is not zero knowledge)
- Verifiable secret ballots. Voting systems where you receive proof that your ballot was cast as you intended, but you can't use the proof to convince anyone else. (To mitigate vote buying/voter intimidation)
- Offering a database where users can query information, but the database operators cannot know what records have been requested
If a product doesn't provide such features, or doesn't make use of a zero knowledge proof, then calling it zero knowledge is nothing more than a brazen lie.
Ok so my desktop is device #1, and mobile is #2. I encrypt a note on desktop, then "query information, but the database operators cannot know what records have been requested" with device #2, it seems this concept fits to end-to-end definition you gave?
I really think both terms are so vague that can be bended in a way that they look interchangeable. And nothing wrong about it.
E2E is a term that dictates that when I send information, only the intented reciepient can decrypt it, under the assumption that the keys are safe.
Zero knowledge proofs is a constuct where I can prove something to you, without leaking any information. For instance, you want to buy a house, but before the seller wants to sign, he wants proof that you can actually pay x $ in down payment. Traditionally you would go down to your bank, get a piece of paper stating that you have x $ locked and only usable for this purchage for the next 60 days. It doesn't say how much you have in your account, where the money is from or anything else. A zero knowledge proof is the same, just digital.
E2E would not help here, because it doesn't prove anything, it's just a term about the comunication being safe.
But misuse of the term is most likely just because they didn't understand it in the first place. It is well defined, but rather abstract.
Take your example, you upload 10 notes to a server with device #1 and then retrieve a few of them with device #2. The server knows exactly what 10 notes you uploaded and exactly which of 3 of the 10 were read by the second device. It also knows when the uploads and downloads occur. Since it knows #2 downloaded a subset of what #1 uploaded, it can conclude that #1 and #2 have some kind of relationship. (eg. Both are your devices, or one device belongs to your friend with whom you have shared 3 of your notes) This is E2E but not zero knowledge.
Now imaging incorporating both E2E and zero knowledge techniques into a note sync system:
1) All notes are encrypted end to end. That is, the servers that store and route notes never learn the secrets necessary to decrypt them
2) Notes sent into the system are routed through a mixnet that uses verifiable shuffles so no one passively watching all of the users and system (or actively running malicious servers or clients) can learn who is sending which note ciphertext.
3) Note ciphertexts are retrieved from the system using private information retrieval so that observers and cheating servers don't learn who is receiving which one or when it's been received.
This system isn't going to learn anything about how many devices you have or who you share with. And it's going to prevent further analysis of metadata: For example, device #1 and #2 keep matching sets of notes and they frequently connect from the same IP addresses, therefore it's safe to assume these devices are owned by the same person. Device #3 requests a subset of notes that were uploaded by #1 and #2, but always from a different country. Now #3 retrieves a note posted by #2 from the same IP address that #1 used recently. Therefore it's safe to assume that the owner of #3 is visiting the owner of #1 and #2.
I'm starting to think that Spider Oak has destroyed the meaning of the term. Apparently Zero knowledge now means E2E.