4 ms·

They encrypt using a Dovecot plugin named Trees that comes from Riseup Labs: How it works: 1. On IMAP log in, the user's cleartext password is passed to the

They encrypt using a Dovecot plugin named Trees that comes from Riseup Labs: How it works: 1. On IMAP log in, the user's cleartext password is passed to the plugin. 2. The plugin creates an argon2 digest from the password. 3. This password digest is used as a symmetric secret to decrypt a libsodium secretbox. 4. Inside the secretbox is stored a Curve25519 private key. 5. The Curve25519 private key is used to decrypt each individual message, using lidsodium sealed boxes. 6. New mail is encrypted as it arrives using the Curve25519 public key. https://0xacab.org/riseuplabs/trees https://0xacab.org/riseuplabs/trees If someone would briefly describe argon2 and libsodium to the non-crypto geeks, it would be appreciated.

pmontra 10y ago
Maybe I misunderstood the meaning of one or more of the steps above. However it seems that if law enforcement wants to look at the messages of a user they only need to make Riseup decrypt for them every message at step 5. The only protection is not logging in because they need the cleartext password to start with. People check their email often, so maybe this is why they are writing > this type of encryption is not end-to-end message encryption. With Riseup’s new system, you still put faith in the server while you are logged in The message should be "if you think you're under investigation, abandon your email and don't login anymore." Another attack is with the received messages: I assume they are all cleartext and can be intercepted before they are encrypted at step 6, with or without the cooperation of Riseup. Messages in a conversation often integrally quote all the previous messages so there might even be no need to force Riseup decrypt anything at step 5.
- Crosseye_Jack 10y ago
  If your going to make Riseup decrypt every message on login, might as well have them mirror the email and encrypt with an LE password (They can still claim every stored email is encrypted) for any future incoming mail. They won't get access to past mail until the user next logs in but would least get access to any future mail the account receives and you are not in control of any email being received.
- maxerickson 10y ago
  The message should be "if you think you're under investigation, abandon your email and don't login anymore." How does that not translate into people who are concerned about investigations simply not using Riseup (at least, for email)? It doesn't seem particularly likely that every member of a group of people will find out about the investigation before any damage is done and then also follow through abandoning their accounts with perfect discipline.
- tankered 10y ago
  As of today, there is no case where the government has pressed the issue about modifying systems. They thought they had the perfect case with San Bernadino/Apple, in fact they are trying to pick the best case in terms of players in order to establish precedent, but they backed down because all of silicon valley rose up in protest. If Riseup became a test case for this it would be a big deal, this would be a legal fight that would bring armies of lawyers who have been dying to litigate this exact scenario, and sillicon valley would also get behind such a case (as they did with Apple). But the government isn't likely to pick Riseup as the target for such a case, they want someone big like Apple. In particular, what you are talking about is a Title III Wiretap (in transit) order with an additional element of technical assistance that requires significant re-architecture that would expose massive take, or enforced lying (endorse a false cert). This would put a huge burden on Riseup, and significantly undermine their operation. A Title III Wiretap order can only be done in very specific cases, it is much harder to obtain one of these than it is for a simple search warrant, or subponea. In fact its so difficult, that in 2015 Google received 15 wiretap orders in total and more thaan 8k search warrants. Not only that, but the government must show they can do data minimization and there is a notification requirement (unlike a search warrant) where they notify the target after 90 days. The tighter particularity requirements built into the statute make this a very good position for Riseup to be in.
  - hackuser 10y ago
    Thanks. With respect, do you have expertise on this issue? It's just useful to know if we're hearing from an attorney who practices in this area or someone who happens to be well-read in it. > there is no case where the government has pressed the issue about modifying systems Do we know that, or would it be more accurate to say 'there is no case that we know of'? And we do have some reason to believe that the U.S. government has pressured large telcos to modify equipment; look up Qwest's story.
fovc 10y ago
I've implemented something similar, but am by no means an expert. Here's my take, experts please correct me! Argon2 was the winner of a password hashing competition. An effective password hasher "stretches" the entropy of the password. In other words, it maps the space P of passwords to K of keys in such a way that guessing a key requires painful testing of every p. Since |P| << |K|, you need to make sure there aren't tricks whereby you can figure out subsets of K that are interesting and skip the expensive computation. You also need to make sure that hashing is expensive; that there are no shortcuts to blaze through all passwords. (Plus a myriad other concerns, including safely running the algorithm without outsiders being able to figure out the passwords based on timing and such) So now you can take a password, make a key, and encrypt stuff. Guessing the key is hard because trying each password is expensive, and there are too many keys to check them all. Libsodium is a crypto library that simplifies crypto down to "symmetric encryption" or "public key encryption" no mucking around with algorithm and parameter choices, constant time compares, etc. So here your password is securely translated into a private key, whose public key pair they use to encrypt everything as it comes in. The middle step is necessary because argon2 stretches passwords into symmetric keys, but you want an assymetric key pair. So you generate a random key pair and encrypt the private key with your argon2 provided key
- hackuser 10y ago
  Great explanation, by the way.
andreareina 10y ago
So they could still be compelled to decrypt a user's emails the next time they log on, yes?
- Crosseye_Jack 10y ago
  > 6. New mail is encrypted as it arrives using the Curve25519 public key. a "going forward" request could start capturing the incoming mail. But yeah reading the how it works section I can not see why they couldn't be compelled to decrypt on next login. Riseup do say:- > To be absolutely clear, this type of encryption is not end-to-end message encryption. With Riseup’s new system, you still put faith in the server while you are logged in. For full end-to-end email encryption, as before, you must use a client that supports OpenPGP (and is not web-based). > We are working to roll out a more comprehensive end-to-end system in the coming year, but until that is ready, we are deploying personally encrypted storage in the mean time.
  - andreareina 10y ago
    My reading is that the libsodium secretbox is on the server; am I mistaken?
    - Crosseye_Jack 10y ago
      The secret box is stored on the server but the argon2 digest which protects it isn't, Looks like it created from the login password > NOTE: the database MUST NOT store the argon2 digest, since this value is the secret key that unlocks locked_secretbox. This is very different than how password hashing for authentication works, where the digest and parameters are stored. So they are storing the locked secretbox on the server which contains the key to decrypt so they can send you the decrypted messages after login. Encrypting the whole message means that the contents and the meta data is secure at rest. If BringYourOwnLawEnforcement came by and imaged the storage without the argon2 digest the messages are useless. But if Riseup were pushed to so then during the users next login the digest could be stored (Breaking the "MUST NOT" rule) when created and then handed over to BringYourOwnLawEnforcement which could then then be used to decrypt the messages as received by dovecot. Now if the contents of those messages where also encrypted with say PGP when BYOLE wouldn't be able to read the message (unless they could break a weak PGP key, had a copy of the PGP Private key too) but they would still get the metadata that comes along with the message. (Time, Date, Sender, etc, etc).
VMG 10y ago
> If someone would briefly describe argon2 and libsodium to the non-crypto geeks, it would be appreciated. Modern low-level primitives for encryption and signing. You can build something like OpenSSL and PGP on top of it, or what's described in your post.

pmontra 10y ago

Maybe I misunderstood the meaning of one or more of the steps above. However it seems that if law enforcement wants to look at the messages of a user they only need to make Riseup decrypt for them every message at step 5. The only protection is not logging in because they need the cleartext password to start with. People check their email often, so maybe this is why they are writing > this type of encryption is not end-to-end message encryption. With Riseup’s new system, you still put faith in the server while you are logged in The message should be "if you think you're under investigation, abandon your email and don't login anymore." Another attack is with the received messages: I assume they are all cleartext and can be intercepted before they are encrypted at step 6, with or without the cooperation of Riseup. Messages in a conversation often integrally quote all the previous messages so there might even be no need to force Riseup decrypt anything at step 5.

Crosseye_Jack 10y ago
If your going to make Riseup decrypt every message on login, might as well have them mirror the email and encrypt with an LE password (They can still claim every stored email is encrypted) for any future incoming mail. They won't get access to past mail until the user next logs in but would least get access to any future mail the account receives and you are not in control of any email being received.
maxerickson 10y ago
The message should be "if you think you're under investigation, abandon your email and don't login anymore." How does that not translate into people who are concerned about investigations simply not using Riseup (at least, for email)? It doesn't seem particularly likely that every member of a group of people will find out about the investigation before any damage is done and then also follow through abandoning their accounts with perfect discipline.
tankered 10y ago
As of today, there is no case where the government has pressed the issue about modifying systems. They thought they had the perfect case with San Bernadino/Apple, in fact they are trying to pick the best case in terms of players in order to establish precedent, but they backed down because all of silicon valley rose up in protest. If Riseup became a test case for this it would be a big deal, this would be a legal fight that would bring armies of lawyers who have been dying to litigate this exact scenario, and sillicon valley would also get behind such a case (as they did with Apple). But the government isn't likely to pick Riseup as the target for such a case, they want someone big like Apple. In particular, what you are talking about is a Title III Wiretap (in transit) order with an additional element of technical assistance that requires significant re-architecture that would expose massive take, or enforced lying (endorse a false cert). This would put a huge burden on Riseup, and significantly undermine their operation. A Title III Wiretap order can only be done in very specific cases, it is much harder to obtain one of these than it is for a simple search warrant, or subponea. In fact its so difficult, that in 2015 Google received 15 wiretap orders in total and more thaan 8k search warrants. Not only that, but the government must show they can do data minimization and there is a notification requirement (unlike a search warrant) where they notify the target after 90 days. The tighter particularity requirements built into the statute make this a very good position for Riseup to be in.
- hackuser 10y ago
  Thanks. With respect, do you have expertise on this issue? It's just useful to know if we're hearing from an attorney who practices in this area or someone who happens to be well-read in it. > there is no case where the government has pressed the issue about modifying systems Do we know that, or would it be more accurate to say 'there is no case that we know of'? And we do have some reason to believe that the U.S. government has pressured large telcos to modify equipment; look up Qwest's story.

fovc 10y ago

I've implemented something similar, but am by no means an expert. Here's my take, experts please correct me! Argon2 was the winner of a password hashing competition. An effective password hasher "stretches" the entropy of the password. In other words, it maps the space P of passwords to K of keys in such a way that guessing a key requires painful testing of every p. Since |P| << |K|, you need to make sure there aren't tricks whereby you can figure out subsets of K that are interesting and skip the expensive computation. You also need to make sure that hashing is expensive; that there are no shortcuts to blaze through all passwords. (Plus a myriad other concerns, including safely running the algorithm without outsiders being able to figure out the passwords based on timing and such) So now you can take a password, make a key, and encrypt stuff. Guessing the key is hard because trying each password is expensive, and there are too many keys to check them all. Libsodium is a crypto library that simplifies crypto down to "symmetric encryption" or "public key encryption" no mucking around with algorithm and parameter choices, constant time compares, etc. So here your password is securely translated into a private key, whose public key pair they use to encrypt everything as it comes in. The middle step is necessary because argon2 stretches passwords into symmetric keys, but you want an assymetric key pair. So you generate a random key pair and encrypt the private key with your argon2 provided key

hackuser 10y ago
Great explanation, by the way.

andreareina 10y ago

So they could still be compelled to decrypt a user's emails the next time they log on, yes?

Crosseye_Jack 10y ago
> 6. New mail is encrypted as it arrives using the Curve25519 public key. a "going forward" request could start capturing the incoming mail. But yeah reading the how it works section I can not see why they couldn't be compelled to decrypt on next login. Riseup do say:- > To be absolutely clear, this type of encryption is not end-to-end message encryption. With Riseup’s new system, you still put faith in the server while you are logged in. For full end-to-end email encryption, as before, you must use a client that supports OpenPGP (and is not web-based). > We are working to roll out a more comprehensive end-to-end system in the coming year, but until that is ready, we are deploying personally encrypted storage in the mean time.
- andreareina 10y ago
  My reading is that the libsodium secretbox is on the server; am I mistaken?
  - Crosseye_Jack 10y ago
    The secret box is stored on the server but the argon2 digest which protects it isn't, Looks like it created from the login password > NOTE: the database MUST NOT store the argon2 digest, since this value is the secret key that unlocks locked_secretbox. This is very different than how password hashing for authentication works, where the digest and parameters are stored. So they are storing the locked secretbox on the server which contains the key to decrypt so they can send you the decrypted messages after login. Encrypting the whole message means that the contents and the meta data is secure at rest. If BringYourOwnLawEnforcement came by and imaged the storage without the argon2 digest the messages are useless. But if Riseup were pushed to so then during the users next login the digest could be stored (Breaking the "MUST NOT" rule) when created and then handed over to BringYourOwnLawEnforcement which could then then be used to decrypt the messages as received by dovecot. Now if the contents of those messages where also encrypted with say PGP when BYOLE wouldn't be able to read the message (unless they could break a weak PGP key, had a copy of the PGP Private key too) but they would still get the metadata that comes along with the message. (Time, Date, Sender, etc, etc).

VMG 10y ago

> If someone would briefly describe argon2 and libsodium to the non-crypto geeks, it would be appreciated. Modern low-level primitives for encryption and signing. You can build something like OpenSSL and PGP on top of it, or what's described in your post.