4 ms·

> 6. New mail is encrypted as it arrives using the Curve25519 public key. a "going forward" request could start capturing the incoming mail. But yeah reading t

> 6. New mail is encrypted as it arrives using the Curve25519 public key. a "going forward" request could start capturing the incoming mail. But yeah reading the how it works section I can not see why they couldn't be compelled to decrypt on next login. Riseup do say:- > To be absolutely clear, this type of encryption is not end-to-end message encryption. With Riseup’s new system, you still put faith in the server while you are logged in. For full end-to-end email encryption, as before, you must use a client that supports OpenPGP (and is not web-based). > We are working to roll out a more comprehensive end-to-end system in the coming year, but until that is ready, we are deploying personally encrypted storage in the mean time.

andreareina 10y ago
My reading is that the libsodium secretbox is on the server; am I mistaken?
- Crosseye_Jack 10y ago
  The secret box is stored on the server but the argon2 digest which protects it isn't, Looks like it created from the login password > NOTE: the database MUST NOT store the argon2 digest, since this value is the secret key that unlocks locked_secretbox. This is very different than how password hashing for authentication works, where the digest and parameters are stored. So they are storing the locked secretbox on the server which contains the key to decrypt so they can send you the decrypted messages after login. Encrypting the whole message means that the contents and the meta data is secure at rest. If BringYourOwnLawEnforcement came by and imaged the storage without the argon2 digest the messages are useless. But if Riseup were pushed to so then during the users next login the digest could be stored (Breaking the "MUST NOT" rule) when created and then handed over to BringYourOwnLawEnforcement which could then then be used to decrypt the messages as received by dovecot. Now if the contents of those messages where also encrypted with say PGP when BYOLE wouldn't be able to read the message (unless they could break a weak PGP key, had a copy of the PGP Private key too) but they would still get the metadata that comes along with the message. (Time, Date, Sender, etc, etc).

andreareina 10y ago

My reading is that the libsodium secretbox is on the server; am I mistaken?

Crosseye_Jack 10y ago
The secret box is stored on the server but the argon2 digest which protects it isn't, Looks like it created from the login password > NOTE: the database MUST NOT store the argon2 digest, since this value is the secret key that unlocks locked_secretbox. This is very different than how password hashing for authentication works, where the digest and parameters are stored. So they are storing the locked secretbox on the server which contains the key to decrypt so they can send you the decrypted messages after login. Encrypting the whole message means that the contents and the meta data is secure at rest. If BringYourOwnLawEnforcement came by and imaged the storage without the argon2 digest the messages are useless. But if Riseup were pushed to so then during the users next login the digest could be stored (Breaking the "MUST NOT" rule) when created and then handed over to BringYourOwnLawEnforcement which could then then be used to decrypt the messages as received by dovecot. Now if the contents of those messages where also encrypted with say PGP when BYOLE wouldn't be able to read the message (unless they could break a weak PGP key, had a copy of the PGP Private key too) but they would still get the metadata that comes along with the message. (Time, Date, Sender, etc, etc).