Implementing end-to-end encryption for Dropbox teams

Why end-to-end encryption for teams

Dropbox already encrypts files at rest with 256-bit AES, but teams handling sensitive or confidential data—finance, healthcare, and similar sectors—want assurance that only they hold the decryption keys. Zero-knowledge, end-to-end encryption delivers that: files are encrypted on the customer's device before upload, so Dropbox itself cannot read the contents.

The design goal was to provide this stronger protection without compromising the simplicity that makes a security feature actually usable. If a system is too complex, it won't be used. The implementation therefore balances security with usability, ensuring that neither Dropbox, unauthorized users, nor malicious third parties can access a team's encrypted files—only the team holds the keys.

The cryptographic design also provides integrity assurance: if a file decrypts successfully, it is cryptographically guaranteed to be identical to what was originally encrypted, meaning it has not been tampered with.

Team-centric key management

Traditional end-to-end encryption systems put key management in the hands of individual users, which creates usability burdens and risks data loss if keys are misplaced. Some systems add key escrow with a trusted third party, but that adds complexity in both implementation and day-to-day use.

By drawing the cryptographic boundary around the team rather than the individual, Dropbox rethought key management entirely. Users don't hold keys; each team has a central team key that all members can access. This key controls access to the team's encrypted data and protects against unauthorized third parties.

This approach delivers several benefits:

• Reduced risk of data loss and implicit key escrow: any member with access—a team admin holding a recovery key, or a member with a registered device—can restore access for everyone.
• Reduced user responsibility: the burden of managing keys shifts from individuals to the team, so a single person's mistake doesn't cause data loss.
• Reduced complexity and improved user experience: no user-level keys and no explicit key escrow simplifies the system, letting team members use end-to-end encryption without worrying about key details.

When team membership changes, admins can rotate keys for the entire team. Rotating keys after a member departs means any leaked keys become useless for accessing new or modified encrypted data. This protects against former members who might misuse previously acquired keys, ensuring the confidentiality of data created after rotation.

Device registration options

Before a user can access encrypted files on a new device, the necessary keys must be available on that device. Admins choose between two registration modes.

Automatic device registration distributes keys to authorized team members through Dropbox's existing authentication and access control infrastructure, for instance during login. Existing devices authorize new devices by wrapping the team key with the new device's public key. If no existing devices are available, a team admin can use a recovery key to facilitate registration. The new device then obtains and uses its version of the team key without manual input.

Manual device registration gives admins more fine-grained control. Team admins personally approve new devices before they can access encrypted files. Admins and members can verify key authenticity by comparing fingerprints, or security codes, of device and team keys out-of-band. This ensures only legitimate team devices—verified to belong to the correct team—can access encrypted files, adding protection against unauthorized access and man-in-the-middle attacks.

Manual verification, while more secure, can be cumbersome and is often skipped in real-world use. It is therefore an optional feature for teams that need the highest assurance.

What end-to-end encryption does not cover

Several threats fall outside the scope of the implementation:

• Device security: encryption protects data during transmission and on Dropbox servers, but not at the device level. Files decrypt automatically during sync or download, so customers should still use full-disk encryption and secure access methods.
• Metadata visibility: encryption focuses on file contents, not metadata. Customers can still search by file name, file type, and creation date, keeping end-to-end encryption practical in everyday use.
• Insider threats: the implementation protects against external threats but does not change internal permissions. Teams should rely on existing access controls to manage data access among members.

Encryption algorithm choices

The implementation uses a hybrid scheme: symmetric encryption for file content and asymmetric encryption for securing keys.

Symmetric file encryption

Plaintext is split into 4 MB blocks, each authenticated with AES-256 in Galois/Counter Mode (GCM), using a random 96-bit nonce per block. AES-GCM ensures authenticity and integrity for individual blocks, and the 128-bit authentication tags from all blocks are combined using HMAC-SHA-256 to extend those guarantees to the entire file. This supports partial encryption and decryption without compromising integrity or order, which is particularly valuable for large files and aligns with Dropbox's existing chunking of file content into 4 MB blocks. The approach also avoids the in-memory processing limits that some APIs like WebCrypto impose.

Asymmetric key wrapping

Secret keys are encrypted using Hybrid Public Key Encryption (HPKE) in single-shot, base mode, combining elliptic-curve cryptography (ECC) with symmetric encryption. The specific suite is DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-256-GCM. When manual device registration is used, HPKE runs in auth mode to encrypt parts of the key chain with sender authentication, which is required for effective key verification.

NIST P-256 was selected over other curves like Curve25519 because it is widely adopted, available in most cryptographic libraries (WebCrypto, CryptoKit, OpenSSL), and specified in FIPS 186-4.

Post-quantum cryptography

The current algorithms do not include post-quantum cryptography (PQC). This is a deliberate, cautious choice:

• PQC reliability for long-term storage remains uncertain due to ongoing standardization; the Kyber algorithm, for example, has undergone several revisions through its NIST standardization process.
• PQC lacks the extensive scrutiny of established algorithms. Some applications use hybrid models with traditional cryptography to ensure baseline security if the PQC component is compromised, at the cost of greater complexity.
• PQC algorithms are not yet widely available in common cryptographic libraries, requiring custom implementations across codebases and increasing the risk of vulnerabilities and human error.
• The practical threat from quantum computing, while significant, is still theoretical.

Despite not using PQC today, the protocol is designed with flexibility to integrate new algorithms as they mature. Kyber and other candidates are being monitored closely, and the algorithm choices will adapt as standards evolve.

What’s next for E2EE at Dropbox

With end-to-end encryption now available for teams, Dropbox is extending access controls to its most security-conscious customers. The implementation was designed with usability as a primary constraint, so that strong data protection does not come at the cost of manageability for the users who need it most.

Additional details on the architecture and operational considerations are covered in the latest Dropbox security whitepaper, which documents the current capabilities and design decisions behind E2EE for teams.