erebion/libervia-backend
Watch
1
0
Fork
You've already forked libervia-backend
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

doc (components, encryption): add documentation on autocrypt for client and email gateway:

Browse source 
fix 456
This commit is contained in:
Goffi 2025-02-28 09:23:35 +01:00
commit 2346dfb461
2 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
doc/components.rst
View file

@ -977,6 +977,18 @@ specification. This works by indicating to client how to format and encrypt the
(in technical terms, it's by telling it to use MIME and OpenPGP) before sending it to the
gateway. This only works with clients implementing this specification.
Autocrypt
~~~~~~~~~
The gateway relays "Autocrypt" headers, which is a way to share public keys without
relaying them to a key server. In layman's terms, it's a way to exchange encryption data
to be able to encrypt messages automatically. However, while better than not using
end-to-end encryption, this method is not as secure as proper management of encryption
keys and authentication of the peer we're talking to.
Please refer to `Wikipedia's Autocrypt page`_ for more details, in particular on its
security model
.. note::
@ -989,4 +1001,5 @@ gateway. This only works with clients implementing this specification.
.. _XEP-0106 (JID Escaping): https://xmpp.org/extensions/xep-0106.html
.. _XEP-0131 (Stanza Headers and Internet Metadata): https://xmpp.org/extensions/xep-0131.html
.. _XEP-0498 (Pubsub File Sharing): https://xmpp.org/extensions/xep-0498.html
.. _Wikipedia's Autocrypt page: https://en.wikipedia.org/wiki/Autocrypt

10
doc/encryption.rst
View file

@ -133,3 +133,13 @@ To handle pubsub signatures from command line, you may use
.. _XEP-0476: Pubsub Signing: OpenPGP Profile: https://xmpp.org/extensions/xep-0476.html
E2EE with Email Gateway
=======================
For compatible gateways, Libervia supports "Relayed" encryption, which is a method for using end-to-end encryption (E2EE). This feature is currently experimental and only works for emails.
If no key is known for an email recipient, Libervia uses Autocrypt. Autocrypt automatically exchanges encryption keys to enable what's called "opportunistic" encryption. While the security isn't as robust as proper key management and peer authentication, it still offers better protection than having no E2EE at all. Autocrypt is only used when a recipient’s key is not known by other, more secure means.
For more information about Autocrypt and its security model, please refer to `Wikipedia's Autocrypt page`_.
.. _Wikipedia's Autocrypt page: https://en.wikipedia.org/wiki/Autocrypt