An open source implementation/description of the encryption/decryption algorithm used by Synology NAS products in their Cloud Sync feature, where one can sync data on the NAS to the likes of Google Drive.
Synology publishes a closed source tool (see below), but I would like to be know how to decrypt my own data with my own password or private key, in the (unlikely) event that I lose access to both a NAS of this type and the closed source tool.
Also, I would like to be able to judge the strength of the encryption.
Official documentation of the encryption algorithm exists, but only on a high level, and the file format is not documented at all.
I've chosen Python, since I think that allows to to express the algorithm most clearly.
(Please note that I explicitly do not want to reverse engineer the closed source 'Synology Cloud Sync Decryption Tool', since I want to avoid doing things that might be construed to be illegal.)
You need to download the source code and install a few dependencies:
git clone this repository.requirements.txt, e.g. by running pip install -r requirements.txt.lz4 binary on your PATH.
apt install liblz4-tool as root.This is a command line tool, and running it comes down to the following.
python -m syndecrypt followed by the supported command line arguments (leave out or add -h for usage information / help).Note that currently this tool does not traverse directories: You either mention all files explicitly on a single command line, either you run it repeatedly.
Feel very free to create a GitHub issue, create a pull request, or drop me a line, if you have any opinions, bug reports, requests, or whatever about this project. Thanks!
Travis CI says: 
Codacy says:
The code in this repository is licensed under the GPLv3; see LICENSE.txt for details.
There are four pieces of information from Synology, unfortunately spread out over multiple places which are not easy to find, and not linked together at all:
'Synology Cloud Sync Decryption Tool', the closed source decryption tool (Windows and Linux only, apparently GUI only) which Synology provides.
It can be obtained through the Synology Support Download Center at https://www.synology.com/en-us/support/download/, then choose a NAS that offers Cloud Sync (many of them, e.g., DS110j).
As of this writing the current version is 009.
(The GUI has a help icon that opens https://help.synology.com/enu/utility/SynologyCloudSyncDecryptionTool which which contains the same infor as the KB article below. It also returns 404 fairly often.)
Synology Knowledge Base article "What is Synology Cloud Sync Decryption Tool?" describing how to use the above decryption tool.
Page 9 of "Cloud Sync White Paper -- Based on DSM 6.0" (archive.org copy) which I received through Synology Support.
The Synology NAS software just lets me check an 'encrypt' checkbox and asks
for a password, and then sends back a zip-file key.zip with files
public.pem and private.pem, without any explanation what I can/should do
with it.
The above documents make it clear that the files are encrypted individually,
and that each file can be decrypted using only the password or only
private.pem.
Until now, there is only one unofficial source of information:
The current code is still basic and does not provide enough explanation yet. I'd still like to do the following:
core to algorithm?encrypt = 0 and compress = 0 modes. (It is an error if either of these fields is not specified.)@SynologyCloudSync/cloudsync_encrypt.info file using password and/or private key.--verify option, to check decryptability and file structure.--verify option also verify @SynologyCloudSync/cloudsync_encrypt.info files.