Advanced Team-Based File Encryption

Dropbox developed an advanced key management solution for team-based file encryption, addressing customer needs for unique team keys anchored in HSMs. The system uses a three-tiered encryption scheme (TEK, NEK, BEK) to enable fast file copies and limit security risks. It incorporates key caching for performance and a chain-of-custody system for integrity. This solution also influences encryption approaches for AI tools like Dropbox Dash. The implementation now supports zero-knowledge, end-to-end encryption for team folders, where files are encrypted on the customer's device before upload, with keys managed centrally by the team. This approach reduces the risk of data loss, shifts key management burden from individuals to the team, and simplifies user experience. It supports automatic and manual device registration modes, with key rotation for enhanced security when team members change. The system uses AES-256-GCM for symmetric file encryption and Hybrid Public Key Encryption (HPKE) with ECC for asymmetric key wrapping. It does not cover device security, metadata visibility, or insider threats beyond external access controls.