ZeroDB – A Peek Under the Hood

So, if I get this right, ZeroDB ends up being a service to persist (to it) a flat dictionary of encrypted buckets.<p>When a given bucket is requested and decrypted by the client, it will have the data as well as the references that let the client treat them as a B-tree, presumably because the clients put them there?<p>I&#x27;m taking that assumption from &quot;The server doesn’t know how individual objects are organized within a tree structure, or whether they even belong to a tree structure at all.&quot;<p>What does this mean for adding a node? Does the client have to traverse the whole B-tree (requesting log(n) entries) down to the point of addition? How about rebalancing, etc? It seems like the clients would be wholly responsible for maintaining the tree.

I&#x27;ve heard nothing but bad things about ZODB. I question the wisdom of building a database on top of a python database.

Interesting that it&#x27;s built on ZODB. For those that aren&#x27;t familiar, in essence ZODB gives your Python application a &#x27;magic dictionary&#x27; which automatically persists any keys written to it. It was probably my ignorance, but while I thought the concept was interesting I ultimately abandoned using it since I couldn&#x27;t find any out-of-band way of inspecting saved data. Eg, sometimes you want to run some ad hoc SQL to see what is stored in a relational database but the only way to access data in ZODB (AFAICT) is within the application itself.<p>It looks like ZeroDB abstracts away these issues, luckily. Is it intended to be a full-scale application data store, or something more specialized like a secrets store?

<i>&quot;The server doesn’t know how individual objects are organized within a tree structure, or whether they even belong to a tree structure at all. ... When a client performs a query, it asks the server to return buckets of the tree as it traverses it, in a just-in-time fashion&quot;</i><p>The server can however infer quite a lot from the order of bucket request, especially which buckets constitute a tree.

What are the advantages of ZeroDB over a database that uses homomorphic encryption like CryptDB?<p>Do they cater to different uses?

How does this work without exposing the client keys in server memory? You still need to send the server your private key to query and decrypt data you specifically didn&#x27;t make via other connected clients, right?<p>Edit: I phrased that wrong. How do you usefully query other user&#x27;s data with only your keys?

I definitely miss something, but...<p>How it is different from a simple mongodb where I store encrypted documents ?

This is a very exciting project, but since the use cases are security related, I am hesitant to use a closed source project. Are there any plans to open source this?

Do you have any comments on using this technology for (1) health information and (2) financial information?

Nice follow-up ZeroDB. Looking forward to the beta!

good to see that you are adding more info about how it works. please keep posting more info. sounds like an interesting technology.

Closed source database? Good luck with your acquisition!