<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><div dir="ltr"><blockquote type="cite">Op 10 apr. 2023 om 18:40 heeft Martin Stenzel <stenzel@bw-host.de> het volgende geschreven:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p>Hi team,</p>
<p>regarding:</p>
<p><a moz-do-not-send="true" href="https://www.mail-archive.com/dovecot@dovecot.org/msg77000.html" class="moz-txt-link-freetext">https://www.mail-archive.com/dovecot@dovecot.org/msg77000.html</a></p>
<p><br>
</p>
<p>I have the very same problem.</p>
<p><br>
</p>
<p><span style="font-family:monospace"><span style="font-weight:bold;color:#ff5454;background-color:#ffffff;">terve:/tmp
#</span><span style="color:#000000;background-color:#ffffff;">
decrypt.rb -k /etc/dovecot/mailcrypt/ecpubkey.pem -f
./1681118363....terve.xy-space.de\,S\=3452\,W\=3515\:2\,S </span><br>
<br>
Key(s) (total: 1)
<br>
- Key type : EC
<br>
- Key digest: a27b201cf7f59f...
<br>
- Peer key : 04aaca0143208904deced2732aaa...<br>
- Encrypted : 4cde641bff16098b91bfaf66...<br>
- Kd hash : 9e229ec6c0...
<br>
<span style="font-weight:bold;color:#ff5454;background-color:#ffffff;">terve:/tmp
#</span><span style="color:#000000;background-color:#ffffff;">
decrypt.rb -k /etc/dovecot/mailcrypt/ecprivkey.pem -f
./16811....terve.xy-space.de\,S\=3452\,W\=3515\:2\,S</span><br>
<br>
<br>
Key(s) (total: 1)
<br>
- Key type : EC
<br>
- Key digest: a27b201cf7f59f978bb9b27947f60a9...
<br>
- Peer key : 04aaca0143208904deced2732aaaf127... <br>
- Encrypted : 4cde641bff16098b91bfaf66c9...<br>
- Kd hash : 9e229ec6c09...
<br>
<span style="font-weight:bold;color:#ff5454;background-color:#ffffff;"><br>
</span></span></p>
<p><span style="font-family:monospace"><span style="font-weight:bold;color:#ff5454;background-color:#ffffff;">terve:/tmp
#</span><span style="color:#000000;background-color:#ffffff;">
decrypt.rb -i -k /etc/dovecot/mailcrypt/ecprivkey.pem -f
./1681118...terve.xy-space.de\,S\=3452\,W\=3515\:2</span><br>
\,S <br>
Version : 2
<br>
Flags : AEAD integrity
<br>
Header length : 255
<br>
Cipher algo : aes-256-gcm (2.16.840.1.101.3.4.1.46)
<br>
Digest algo : sha256 (2.16.840.1.101.3.4.2.1)
<br>
<br>
Key derivation
<br>
- Rounds : 2048</span></p>
<p><span style="font-family:monospace">...<br>
<br>
</span></p>
<p>N. B. Before posting I arbitrarily removed numbers from the
output, maybe paranoid...<br></p></div></blockquote><div><br></div>Why?<div><br><blockquote type="cite"><div dir="ltr"><p>
</p>
<p><br>
</p>
<p>Environment:<br>
</p>
<p>openSuSE Linux server.</p>
<p>dovecot version 2.3.20</p>
<p>openssl version 1.1.1</p>
<p>ruby version 3.1.2p20</p>
<p>decrypt.rb version <a moz-do-not-send="true" href="https://gist.github.com/cmouse/882f2e2a60c1e49b7d343f5a6a2721de" class="moz-txt-link-freetext">https://gist.github.com/cmouse/882f2e2a60c1e49b7d343f5a6a2721de</a><br>
</p>
<p><br>
</p>
<p>This is the way I generated the keys:</p>
<pre id="codecell9">openssl ecparam -name prime256v1 -genkey | openssl pkey -out ecprivkey.pem
openssl pkey -in ecprivkey.pem -pubout -out ecpubkey.pem
</pre>
<p></p>
<p><br>
</p>
<p>This is the 10-mailcrypt.conf:</p>
<p><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff;">mail_plugins =
$mail_plugins mail_crypt
</span><br>
<br>
plugin <span style="color:#000000;background-color:#18b2b2;">{</span><span style="color:#000000;background-color:#ffffff;">
</span><br>
#fts_index_fs =
crypt:set_prefix=fscrypt_index:posix:set_prefix=/tmp/fts
<br>
mail_crypt_global_private_key =
</etc/dovecot/mailcrypt/ecprivkey.pem
<br>
mail_crypt_global_public_key =
</etc/dovecot/mailcrypt/ecpubkey.pem
<br>
mail_crypt_save_version = 2
<br>
<span style="color:#000000;background-color:#18b2b2;">}</span><br>
</span> </p>
<p>Encryption of incoming (thanks to dovecot-lda), as well as
outgoing mails works perfectly.<br>
</p>
<p><br>
</p>
<p>But for me it is more a feature than a bug, since now, even as
root I am not able to decrypt users mails.</p>
<p>This serves plausible deniability. <br>
</p>
<p><br>
</p>
<p>But how can I make sure, that NOBODY ELSE can decrypt with this
specific private key?</p>
<p>Is there ANY OTHER way to decrypt the mails besides the script?<br>
</p>
<p><br>
</p>
<p>Have a nice Monday, and THANKS for taking your time!<br>
</p>
<p>Martin, Cologne<br>
</p>
<p><br>
</p>
<p>P. S. Did you notice, that as an argument (-k) the results are
the same, both with private and public key?</p>
<p>P.P.S. If i give the "-w" argument and a file name, the file
remains empty, tried even that without success.<br>
</p>
<p>P.P.P.S. If I call the script with ruby version 2 it bails out...<br>
</p>
<p><br>
</p>
<lt-container></lt-container>
</div></blockquote></div></body></html>