search

linagora / tmail-backend

GNU Affero General Public License v3.0
41 stars 22 forks source link

Encrypted message #99

Closed Arsnael closed 3 years ago

Arsnael commented 3 years ago

After being able to encrypt a byte[] using a previously stored public key in #98, we should be able to encrypt the body of a mime4j.Message and return it as an other mime4j.Message.

From https://tools.ietf.org/html/rfc3156#section-4:

   OpenPGP encrypted data is denoted by the "multipart/encrypted"
   content type, and MUST have a "protocol" parameter
   value of "application/pgp-encrypted".  Note that the value of the
   parameter MUST be enclosed in quotes.

   The multipart/encrypted MIME body MUST consist of exactly two body
   parts, the first with content type "application/pgp-encrypted".  This
   body contains the control information.  A message complying with this
   standard MUST contain a "Version: 1" field in this body.  Since the
   OpenPGP packet format contains all other information necessary for
   decrypting, no other information is required here.

   The second MIME body part MUST contain the actual encrypted data.  It
   MUST be labeled with a content type of "application/octet-stream".

   Example message:

      From: Michael Elkins <elkins@aero.org>
      To: Michael Elkins <elkins@aero.org>
      Mime-Version: 1.0

      Content-Type: multipart/encrypted; boundary=foo;
         protocol="application/pgp-encrypted"

      --foo
      Content-Type: application/pgp-encrypted

      Version: 1

      --foo
      Content-Type: application/octet-stream

      -----BEGIN PGP MESSAGE-----
      Version: 2.6.2

      hIwDY32hYGCE8MkBA/wOu7d45aUxF4Q0RKJprD3v5Z9K1YcRJ2fve87lMlDlx4Oj
      eW4GDdBfLbJE7VUpp13N19GL8e/AqbyyjHH4aS0YoTk10QQ9nnRvjY8nZL3MPXSZ
      g9VGQxFeGqzykzmykU6A26MSMexR4ApeeON6xzZWfo+0yOqAq6lb46wsvldZ96YA
      AABH78hyX7YX4uT1tNCWEIIBoqqvCeIMpp7UQ2IzBrXg6GtukS8NxbukLeamqVW3
      1yt21DYOjuLzcMNe/JNsD9vDVCvOOG3OCi8=
      =zzaA
      -----END PGP MESSAGE-----

      --foo--

The method should look like:

mime4j.Message encryptMessage(mime4j.Message message, Key key);

DoD: Unit tests proving you can encrypt correctly a mime4j.Message

chibenwa commented 3 years ago

I don't agree.

Here the API should be something like:

mime4j.Message (with unencrypted body) => mime4j.Message (with encrypted armored body)

The spec: https://tools.ietf.org/html/rfc3156

Example of encrypted email:

      From: Michael Elkins <elkins@aero.org>
      To: Michael Elkins <elkins@aero.org>
      Mime-Version: 1.0
      Content-Type: multipart/encrypted; boundary=foo;
         protocol="application/pgp-encrypted"

      --foo
      Content-Type: application/pgp-encrypted

      Version: 1

      --foo
      Content-Type: application/octet-stream

      -----BEGIN PGP MESSAGE-----
      Version: 2.6.2

      hIwDY32hYGCE8MkBA/wOu7d45aUxF4Q0RKJprD3v5Z9K1YcRJ2fve87lMlDlx4Oj
      eW4GDdBfLbJE7VUpp13N19GL8e/AqbyyjHH4aS0YoTk10QQ9nnRvjY8nZL3MPXSZ
      g9VGQxFeGqzykzmykU6A26MSMexR4ApeeON6xzZWfo+0yOqAq6lb46wsvldZ96YA
      AABH78hyX7YX4uT1tNCWEIIBoqqvCeIMpp7UQ2IzBrXg6GtukS8NxbukLeamqVW3
      1yt21DYOjuLzcMNe/JNsD9vDVCvOOG3OCi8=
      =zzaA
      -----END PGP MESSAGE-----

      --foo--

Some sample API: 

class PGPEncryptor {
    Message encrypt(Message message, byte[] key) {...}
}
chibenwa commented 3 years ago

Playing with enigmail, sending a mail to self we end up with the following mime:

Return-Path: <btellier@linagora.com>
Delivered-To: btellier@linagora.com
Received: from 172.17.0.1 (EHLO incoming.linagora.com) ([172.17.0.1])
          by incoming.linagora.com (JAMES SMTP Server ) with ESMTP ID 700901382
          for <btellier@linagora.com>;
          Tue, 30 Mar 2021 10:51:18 +0000 (GMT)
Received: from smtp.linagora.com (smtp.linagora.com [54.36.8.78])
    by incoming.linagora.com (Postfix) with ESMTPS id 80C439D0B4
    for <btellier@linagora.com>; Tue, 30 Mar 2021 10:51:18 +0000 (UTC)
Received: from [192.168.1.82] (unknown [222.252.23.73])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by smtp.linagora.com (Postfix) with ESMTPSA id B899141999
    for <btellier@linagora.com>; Tue, 30 Mar 2021 12:51:17 +0200 (CEST)
To: =?UTF-8?Q?Beno=c3=aet_STG=5fTELLIER?= <btellier@linagora.com>
X-LINAGORA-Copy-Delivery-Done: 1
From: "btellier@linagora.com (OpenPaaS)" <btellier@linagora.com>
Autocrypt: addr=btellier@linagora.com; keydata=
 mQENBFcF1vwBCAC4zl/Bp7fnWiDMxuLK6hQJIN7AW0R2v2RutwA8M2R1aq6NfN44WKc6a62L
 OkA5RdqpVjJHuTC19EmkyiDQMNN7FNPHjNm80tiy5VFqw3EpIGrj3LQ6qS7ypbiXHCci4tw2
 QzNPMgCUJURcTpchxI20m+UGZ0FFw63ZUEMxM1mJKvdjSuEq4zQvinUqW1fQ+g1gbl+Mg5h6
 rEA0+jt9n57uLG237GaVVU9m4saXQUVNNjasl6fIdtfYdj+bpjpi+Pih3yNHwbR/grRAqQbi
 mRqfui5vA8QE6wTtR6oiMjr7ssYYQlTZa9n05gu2OvERndyVUG+CKBC60zZ4gQyKipqPABEB
 AAG0JlRlbGxpZXIgQmVub2l0IDxidGVsbGllckBsaW5hZ29yYS5jb20+iQE3BBMBCAAhBQJX
 Bdb8AhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEGvZGBNu4WQm5kMH/Am101bQLdSm
 o6V11iHPLReLvo3812OqRRtSPWsgCll9n3oG0OG1VSV/MNUdd872ewghWhpxTe9cDop+hhqt
 CIRHr1ihoEmQu9Gnt4FJ3NdcMu/GHfH7+co6IvvRBLvlfYvzCQguepBiaBcGTWdYf0GVANVw
 JpdUJghvNPR89zdiRCKM2WRttyRLTp83BPwqUHtEVzdwy3xh8dheImJqXm0EK3idNKPvJFR5
 juq3+VVP2nCDvPhRlvhwD07/xeuxS1Rs/C6SRxzNBRvFzm7fqc5f7mVXtZgD56AA/u58uFPS
 6S1qYrDcIsVT+4rhkyDYW9Oc6W7NtQ2G3Vdo2hlrBCm5AQ0EVwXW/AEIALxAi5lEQXCyyFb4
 bmlIGIJ1Yz1Ze6fojWsmJoD1wCvrKVsQZ6hLH0AdZ6DUsKrAYdUwX1NNNGGjQXTBlMxyMluy
 2374VXOMc2Q9wVFJ3b3i2TFYtoAio+eWeiilzU0HS+MtYiHtL3ul7XhQKE55CuoVauBEZcSu
 i4x42/eDN9CP/P/yx1XLBJkfn9Uewmy9/1PhRd1hNIwkgO2hBn8llUw6LJdr/pWcH5K5o87X
 MYfbu5OlsREzhuGnpRiL5t+gcDXXUAOmhsDgi4H6qK8bA3+RgkThXKBIkfSUIqqQyhz+ajnu
 xUAOJ4yWNFERvN7S/LViVAb1JT7Rm8lj3iYecJUAEQEAAYkBHwQYAQgACQUCVwXW/AIbDAAK
 CRBr2RgTbuFkJv0NB/0X3lshAvz5yC1wauJ4w8yEWyC2oZsGU3tnAL+npPqbSqNQlWRx410x
 bTynhMV8G9u6N6OwoZs+FkvNu5zlg8zYpt3gYmZVixdovcR2lkR0D5nkhtY5ywG6jTXE6W4Y
 7JaB249WmHz/P7YRobp7vqT35TY9muR4DPuehMeb/3LkfcSyuibXQKTqEieA5bw+86efHkjm
 /jn+ZX+4X7Ta58xVeiplMlX8QCy4EwpqXPlchaArv+f0O7w90ZavE7NrRjpu06EzTp7AHvQO
 F775B7hAeVaECNAYO7BAKMAT9g2grwWDHVA5IzxFcpdT1BBwnUrtBg1NJjl32YuvjCCJYw1S
Message-ID: <803719a0-cf65-3e5a-2bb4-9455f2ec0d75@linagora.com>
Date: Tue, 30 Mar 2021 17:51:06 +0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.5.0
MIME-Version: 1.0
Subject: ...
Content-Type: multipart/encrypted;
 protocol="application/pgp-encrypted";
 boundary="3Kx1tzAqlXtXY9i9xJvCGD0ynZqtYi7tf"

This is an OpenPGP/MIME encrypted message (RFC 4880 and 3156)
--3Kx1tzAqlXtXY9i9xJvCGD0ynZqtYi7tf
Content-Type: application/pgp-encrypted
Content-Description: PGP/MIME version identification

Version: 1

--3Kx1tzAqlXtXY9i9xJvCGD0ynZqtYi7tf
Content-Type: application/octet-stream; name="encrypted.asc"
Content-Description: OpenPGP encrypted message
Content-Disposition: inline; filename="encrypted.asc"

-----BEGIN PGP MESSAGE-----

hQEMA3PwMMHFNykQAQf9F2Fr+lYxRPW8T1KD8hF31AvdoswN03QRkInkOai9cbV4
wnZr3SJKAdFhz4zTejcI8o7+0RReGPjmEhBma5YxV5VRb15DUNEE9UqLYpQIcph4
IQQnvxzNO3sPN2QXPGOsKuKxGXzwV4WWow0f+SKAgSOQHYPuSXv1jbwb70CWMOvq
RxsmAt/9Ifzrkt14K2d9DHBzOlTs0KYDVFnJQKe97xIu9it+R7z7lkdwcKuoUSun
gqpX7Xucru9NdkFZj4OKIqfRDJz6C88LiwsohTnmgo1ilNPFx2tIYNGtXZNQJTvA
6MwyXUNI0xX0Fr42IVuH8Y+LLQOXBrnKaW0r4CmemtLAvwHYAj+E4RXe9UdXcvNA
GgeMNVwSehtyt2bd6e5j3sZk3/1Pnz6MrR/xk0BzhV9WiDlJ+a2QkNMlLzzUiPTV
Hx0l6l6XT5fcWemiKdNSHersgY0e4q/RcuDCL0xfvZok9kgj4+/M6Vyk9YnV3TFB
qTBWbzzL4BjOmQy7CDl9TG7MSWqbabc0I0cw6FZqg0KIfnnpbjjr9v4iFwatWa0P
Hc86GhP+VYkWBDDIWt06vaZnRS7pctp599a05YNZoREvB0C1OBj6Gnx6afvWs7Ya
UHzX4iWcxcJVaT8iMBZ818R+J4mlzZ690B9A2sDoTFIKc5vQzap4VNIybyEDhMiG
LmlyjDSV0QXujx3CRGBt6bJUAmeX0dKh7O8uSabTPqHrWFKmidU/l4qhj0CPMG1E
REDKPWiI1bX7eQzhxkda/nJ46SguStEl40KpHCyMnEhTqtLft0zwgiku6ilHMFNK
/wYkSZar4FpcZbofRz9NjvagrAFIahojlhPTKU9fv9eD
=pgPA
-----END PGP MESSAGE-----

--3Kx1tzAqlXtXY9i9xJvCGD0ynZqtYi7tf--

Taking the encrypted portion of the message:

% gpg --decrypt gpg.enc
Content-Type: multipart/mixed; boundary="s2cxjjyHnl8ToV8rOTp49oon7FIkkq96P";
 protected-headers="v1"
From: "btellier@linagora.com (OpenPaaS)" <btellier@linagora.com>
To: =?UTF-8?Q?Beno=c3=aet_STG=5fTELLIER?= <btellier@linagora.com>
Message-ID: <803719a0-cf65-3e5a-2bb4-9455f2ec0d75@linagora.com>
Subject: toto

--s2cxjjyHnl8ToV8rOTp49oon7FIkkq96P
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

test

--s2cxjjyHnl8ToV8rOTp49oon7FIkkq96P--
chibenwa commented 3 years ago

If you ask yourself what the Autocrypt header is: https://autocrypt.org/level1.html#the-autocrypt-header

I think we can safely ignore it.