[7.306] Inline Encryption Possible?

SveN · #1 (**permalink**) 03-16-2009, 07:37 AM

Hi,
we are using Email Encryption via PGP. If I send an PGP Encrypted Email
to Lotus Notes the receiver only sees two attachments and can only
decrypt them if he saves the second attachment, renames it to *.PGP.

My Question: Is it possible to activate Inline Encryption?
So that the receiver receives an Email which contains
the Encrypted Mail inside the normal body?

Body would then contain:

Code:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.8 (GNU/Linux)

hQIOA/1lYCdt4x2xEAf/dyt57mD0yTajy8Glgs4L5mjx6O/G4TpD8Cp9lZFxd3Vy
gjOQIuMGnNkOwrsksiBe8iifW/8Qoov2Fc2lCT+S6ABsX4P8Sgc3jp+9EC/qIyUm
OQjb7iy5boR6b7sFkHqpGIgxh6eYCaT/9IKuTGNH9Et6Li9JeDeVcPv02cCux0IJ...

cu SveN

BAlfson · #2 (**permalink**) 03-16-2009, 12:18 PM

Sven, I don't understand your scenario. Are you sending an encrypted email to a Notes server behind an Astaro, or are you behind an Astaro, but the Notes server is not?

Cheers - Bob

SveN · #3 (**permalink**) 03-16-2009, 12:25 PM

I am behind the ASG, and the ASG encrypts the Email
for the notes receiver. It seems that Notes isn't aware of
the "application/pgp-encrypted" Mime Type. So it displays
two ugly attachments one contains "Version: 1" and the other
one "-----BEGIN PGP MESSAGE-----...". If you have a look at
the Email the ASG sends

Code:

MIME-Version: 1.0
Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
	boundary="=-fQbxiiloSTJsKxY8wyrq"

--=-fQbxiiloSTJsKxY8wyrq
Content-Type: application/pgp-encrypted
Content-Transfer-Encoding: 7bit

Version: 1

--=-fQbxiiloSTJsKxY8wyrq
Content-Type: application/octet-stream
Content-Transfer-Encoding: 7bit

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.8 (GNU/Linux)

hQIOA/1lYCdt4x2xEAf/dyt57mD0yTajy8Glgs4L5mjx6O/G4TpD8Cp9lZFxd3Vy
gjOQIuMGnNkOwrsksiBe8iifW/8Qoov2Fc2lCT+S6ABsX4P8Sgc3jp+9EC/qIyUm
OQjb7iy5boR6b7sFkHqpGIgxh6eYCaT/9IKuTGNH9Et6Li9JeDeVcPv02cCux0IJ
LNi24S8gSfI4KErG2Whanm2gvISCPnU8e4sfRir39xpnne2LgzWyieCdz+zkFb0e
+YmLzjLBMnWQU/tA3CmipUMMQlHzjPSM6/C5g5OQlL+ThPkJJQBPX7cQQtfavW5j

it seems that Notes cannot display "application/pgp-encrypted"....

So it would be cool to have "-----BEGIN PGP MESSAGE-----..." in a simple Text Body...

BAlfson · #4 (**permalink**) 03-16-2009, 01:00 PM

I don't know Notes, but with Exchange, I believe that encryption/decryption occurs at the client, not in the Exchange server. That requires installing a certificate before the client can exchange encrypted messages with a correspondent. Is that the behavior you're seeing?

Cheers - Bob

SveN · #5 (**permalink**) 03-16-2009, 01:26 PM

Yes and No. The Notes Server and/or Client has nothing to do with en- oder decryption. They use an external tool for that (WinPT).

So they only want see the "-----BEGIN PGP MESSAGE-----..." in the Body of the Email and so they can copy it to the clipboard and decrypt it over there with this tool...

BAlfson · #6 (**permalink**) 03-16-2009, 04:15 PM

SveN, I have read about PGP, but only have used certificates. It seems strange to me that there wouldn't have been more complaints about this or that Astaro would make this work any differently from the standard. If this was working before the 7.400 Up2Date, then it sounds like a new bug.

According to the Astaro documentation, if the Astaro does not have the sender's public key installed, and it can't find the public key on an OpenPGP Keyserver, it will not decrypt an incoming email. Once the key is installed, the Astaro decrypts incoming messages. This sounds similar to the situation you describe.

In consulting RFC4880, I find a description of the proper use of ASCII armor, but I couldn't find whether its use was a required part of the standard for composing a compliant message. I'm learning about PGP, is the use of ASCII armor required?

Cheers - Bob
PS I guess I still don't understand what they need. I thought you were looking for ACSII armor around the public key, but in rereading now, I see that was a false assumption. Are you saying that the message itself should be a separate attachment beginning with the ASCII armor header? I'm pretty sure the actual file is flat, and that it's the receiving email server that splits that file into header, message and attachments. Could it be that they have not finished configuring their Notes server?

SveN · #7 (**permalink**) 03-17-2009, 08:45 AM

Hi,

mainly Astaro uses rfc3156.txt for PGP Encryption and Decryption.
But if you have a client that is not aware of this RFC (the Client does not know about the "Content-Type: application/pgp-encrypted") it will display two ugly attachments (e.g. you could use Thunderbird without the Enigmal-Plugin you would see what I mean).

So my question is: if you have such a client, would it be possible to send the PGP-Enrypted Message inside a normal mail body as Text (with having "Content-Type: application/pgp-encrypted"). Something like this:

Code:

Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit
 
-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.8 (GNU/Linux)
 
hQIOA/1lYCdt4x2xEAf/dyt57mD0yTajy8Glgs4L5mjx6O/G4TpD8Cp9lZFxd3Vy
gjOQIuMGnNkOwrsksiBe8iifW/8Qoov2Fc2lCT+S6ABsX4P8Sgc3jp+9EC/qIyUm
OQjb7iy5boR6b7sFkHqpGIgxh6eYCaT/9IKuTGNH9Et6Li9JeDeVcPv02cCux0IJ
LNi24S8gSfI4KErG2Whanm2gvISCPnU8e4sfRir39xpnne2LgzWyieCdz+zkFb0e

cu SveN

BAlfson · #8 (**permalink**) 03-17-2009, 01:17 PM

Thanks for that information; this is the first time I've read RFC3156. I'm almost certain that there's no option in the Astaro to send an encrypted email without the RFC3156 "header" information.

Should Astaro make this an option because it's an alternative standard, or is the problem that the client on the Notes-end is not Notes-aware or is otherwise non-standard?

Cheers - Bob

SveN · #9 (**permalink**) 03-17-2009, 01:25 PM

Hi,
I think it should be configurable for every Public Key
if this user wants to have RFC3156 Header or not.

Problem is that some Mail Clients (like Notes or Thunderbird
without the encrytion Plugin) are not aware of this RFC.
And those users will use an external Tool (e.g. WinPT) to
decode their Emails out of the message Body, but if you
send them RFC3156 Header they do not see anything in the
message body and you are unable to communicate with them...

So I think this would be a nice feature!

pgruber · #10 (**permalink**) 03-20-2009, 09:38 AM

We don't support inline encryption. The main problem with it is, that there is no real standard for encrypting attachments with PGP/Inline.

Also, most mail clients do support PGP/MIME. I am surprised to hear that clients not supporting it are still in use.