Bug 78862 - Feature request: Cell protection with strong encryption and other file security possibilities
Summary: Feature request: Cell protection with strong encryption and other file securi...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: low enhancement
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: Cell-Protection
  Show dependency treegraph
 
Reported: 2014-05-18 14:17 UTC by Ralf
Modified: 2017-07-20 08:05 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ralf 2014-05-18 14:17:09 UTC
Some professional applications require secure cell protection or secure file protection possibilities without encrypting the file as a whole. I do not know any spreadsheet application, which offers secure cell protection with strong encryption. The insecure cell protection offered by LibreOffice is in line with standards of other leading spreadsheet applications if I understand the situation correctly.

If spreadsheets with secure cell protection are required, commercially available solutions can be purchased. These solutions provide protection of XLS and XLSX files via add-ins for MS Excel. I do not know about similar possibilities for ODS files and I do not know about similar possibilities without using MS Excel. Other spreadsheet protection mechanisms like time expiration or locking a file to a specific location are offered by specialised providers for MS Excel as well.

I think that each of these three file security possibilities would be a considerable gain for LibreOffice in certain professional spreadsheet applications:

a) Secure cell protection with strong encryption
b) Time expiration of a spreadsheet
c) Locking a spreadsheet to a specific location

I assume that implementing any of these security features requires substantial effort and expertise. Nevertheless such effort might be worth it, because LibreOffice Calc would become the only spreadsheet application which includes such security features without the use of commercial third-party add-ins. Demand for such features exists as there are specialised providers.

This feature request suggests the introduction of cell and file secure mechanisms without encrypting the spreadsheet completely. It is my intention not to be specific, because I cannot judge, which implementation could be practicable. My preferred security feature is: a) Secure cell protection with strong encryption.
Comment 1 Joel Madero 2014-05-21 01:36:15 UTC
Thank you for reporting this enhancement request! I can confirm that this is a valid enhancement request on:
Version: 4.3.0.0.alpha0+ Build ID: 84862db95a5e22b9ef89baa2a8a5deeffefbdef6
Date:   Thu Apr 24 21:43:16 2014 +0300
Platform: Ubuntu Linux 14.04 x64
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 
As I've been able to confirm the enhancement request I am marking as:

New (confirmed)
Enhancement
Low - incredibly hard to accomplish and there are workarounds already (any professional should know that encrypting disk is best). Also this will add complications for interoperability.

Note: Enhancements are accepted by volunteers almost exclusively, because this one is a huge and substantial change - it is my guess that it's unlikely to be taken on any time soon. If you believe that this will really benefit that many professionals, maybe you can secure the funds to pay a developer to take this on (that would be fantastic)

Removed: security - this is really only used for security bugs, not for enhancement requests
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 
LibreOffice is powered by a team of volunteers, every bug is confirmed (triaged) by human beings who mostly give their time for free. We invite you to join our triaging by checking out this link:
https://wiki.documentfoundation.org/QA/BugTriage

There are also other ways to get involved including with marketing, UX, documentation, and of course developing -  http://www.libreoffice.org/get-help/mailing-lists/. 

Lastly, good bug reports help tremendously in making the process go smoother, please always provide reproducible steps (even if it seems easy) and attach any and all relevant material
Comment 2 Chris Sherlock 2014-05-21 17:02:19 UTC
I like the idea... except for this:

"Time expiration of a spreadsheet"

I'd prefer LibreOffice didn't become the SnapChat of spreadsheets.
Comment 3 Ralf 2014-05-21 22:46:31 UTC
I focus the following discussion on topic "a) Secure cell protection with strong encryption" and structure my contribution along these sections:

1. Demand for solutions
2. Feasible solution is add-on rather than change of concept
3. Commercially viable development set-up

1. Demand for solutions

Currently workaround solutions do not exist for LibreOffice and ODS files. Of course encrypting a disk, a file container or a file can result in high data security for the encrypted spreadsheet as a whole. However, there are situations when one wants to distribute a spreadsheet but when one wants to hide or protect some or all formulas in the spreadsheet, so that the suggested method to encrypt a disk does not help. The main area of concern for partial file encryption is protection of intellectual capital. Another example is protection of confidential business information, which is required in the calculation procedure.

An internet search about hiding and protecting cells and formulas in spreadsheets shows the high level of interest in the topic. Such an internet research also reveals that only a minority seems to be aware that common spreadsheet applications "protect" the cells with a password, but that a serious security level is not provided.

An OpenOffice.org forum discussion about "Calc How to Protect & Secure Documents" (thread from Oct 2010 until Feb 2011, http://www.oooforum.org/forum/viewtopic.phtml?t=108588) provides some (partly outdated and incomplete) information about solutions offered in the market. Unfortunately, these solutions and also other searchable solutions rely on Excel and work as add-ins to Excel.

The high coverage of the topic in the internet and the existence of a market for commercial solutions show the demand for such security features.

2. Feasible solution is add-on rather than change of concept

I agree that a solution is hard to accomplish and conveys complications for interoperability if one wants to change the current concept of cell protection. However, one can consider an additional layer similar to the different add-in solutions for Excel. Then interoperability is not an issue anymore. I also consider solving the problem more practicable. At least there is a sort of proof of concept due to the different add-in solutions for Excel.

Most Excel add-ins produce an executable file. Cell entries can be changed, but formulas are not visible anymore. Such solutions lock all formulas irrespective of the specific cell protection status.

A more flexible solution relies on macro programming. This approach can result in strong encryption in line with the cell protection selected for each cell individually. A third-party vendor offers such a solution for Excel off-the-shelf.

An implementation could be part of the general LibreOffice code. It could also be a LibreOffice Extension, which is probably easier to develop due to its independence from the general code.

3. Commercially viable development set-up

I understand the suggestion to pay for the development of commercially interesting enhancements of LibreOffice. However, my enterprise takes a different route. Switching to Excel and purchasing a commercially available off-the-shelf security add-in solution is far more economical than paying for the development of a security mechanism for ODS files and LibreOffice.

Nevertheless I consider the development of such security tools as a business opportunity for a developer, for a group of developers or for a company, which already operates in the LibreOffice environment. An extension could be marketed similarly as the add-in solutions for Excel based on license sales. As LibreOffice has grown considerably, the market size could be sufficient for a LibreOffice/ODS product.