s/mime private key

[martin_hansen]

Hello,

I would like to use s/mime but I am a little concerned how Horde
IMP handles the private key on the server. It is not my server, I
have only a shared webhosting plan. Because of this I need to know
if the server admin can retrieve my private key and can read my
s/mime encrypted e-mails. Also I need to know if I have to enter my
private key password each time I want to read a s/mime encrypted e-
mail.

Martin



--
Horde mailing list - Join the hunt: http://horde.org/bounties/#horde
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: horde-unsubscribe@...

[lst_hoe02]

Zitat von martin_hansen@...:

> Hello,
>
> I would like to use s/mime but I am a little concerned how Horde
> IMP handles the private key on the server. It is not my server, I
> have only a shared webhosting plan. Because of this I need to know
> if the server admin can retrieve my private key and can read my
> s/mime encrypted e-mails. Also I need to know if I have to enter my
> private key password each time I want to read a s/mime encrypted e-
> mail.
>

The private key is stored encrypted in the database. You have to  
provide the matching password once per session to get the private key  
stored unencrypted in your encrypted session data. That said it is  
nevertheless possible for the server admin to alter the PHP code of  
Horde/IMP to steel the password. But if you don't trust them, use  
another Provider or do S/MIME only from your local client.

Regards

Andreas


--
Horde mailing list - Join the hunt: http://horde.org/bounties/#horde
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: horde-unsubscribe@...

[Michael Menge]

Quoting martin_hansen@...:

> Hello,
>
> I would like to use s/mime but I am a little concerned how Horde
> IMP handles the private key on the server. It is not my server, I
> have only a shared webhosting plan. Because of this I need to know
> if the server admin can retrieve my private key and can read my
> s/mime encrypted e-mails. Also I need to know if I have to enter my
> private key password each time I want to read a s/mime encrypted e-
> mail.
>

The Key is encrypted with your password in the preferences backend.
You have to enter the password at least one per session, then it is
stored in the session data. You kan make horde forget the password.

But as log as it is stored in the session everyone with access to
the session data and pref backend can use the key.

There has been feature requests to use the crypto device of the
browser but as far as i know it is not implemented yet.


--------------------------------------------------------------------------------
M.Menge                                Tel.: [phone]
Universität Tübingen                   Fax.: [phone]
Zentrum für Datenverarbeitung          mail:  
michael.menge@...
Wächterstraße 76
72074 Tübingen

--
Horde mailing list - Join the hunt: http://horde.org/bounties/#horde
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: horde-unsubscribe@...

[martin_hansen]

Hello,

thank you for your replies. Does Horde encrypt the private key by
itself again? I ask because usually the private key has already
been encrypted during export on my computer. So the Horde s/mime
session password is different to the password I have originally
encrypted the private key with on my computer?

Martin



On Fri, 30 Oct 2009 20:47:12 +0100 Michael Menge
<michael.menge@...> wrote:

>Quoting martin_hansen@...:
>
>> Hello,
>>
>> I would like to use s/mime but I am a little concerned how Horde
>> IMP handles the private key on the server. It is not my server,
>I
>> have only a shared webhosting plan. Because of this I need to
>know
>> if the server admin can retrieve my private key and can read my
>> s/mime encrypted e-mails. Also I need to know if I have to enter
>my
>> private key password each time I want to read a s/mime encrypted
>e-
>> mail.
>>
>
>The Key is encrypted with your password in the preferences
>backend.
>You have to enter the password at least one per session, then it
>is
>stored in the session data. You kan make horde forget the
>password.
>
>But as log as it is stored in the session everyone with access to
>the session data and pref backend can use the key.
>
>There has been feature requests to use the crypto device of the
>browser but as far as i know it is not implemented yet.
>
>
>-------------------------------------------------------------------
>-------------
>M.Menge                                Tel.: [phone]
>Universität Tübingen                   Fax.: [phone]
>Zentrum für Datenverarbeitung          mail:  
>michael.menge@...
>Wächterstraße 76
>72074 Tübingen

--
Horde mailing list - Join the hunt: http://horde.org/bounties/#horde
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: horde-unsubscribe@...

[Michael Menge]

Quoting martin_hansen@...:

> Hello,
>
> thank you for your replies. Does Horde encrypt the private key by
> itself again? I ask because usually the private key has already
> been encrypted during export on my computer. So the Horde s/mime
> session password is different to the password I have originally
> encrypted the private key with on my computer?
>

On uploading to horde you have to enter the old password
(from export) and the new password (for the usage in horde).
If you have exported your key in the pem format you could
insert it in the database (you may have to convert linebrakes)
and use it with the export password.




--------------------------------------------------------------------------------
M.Menge                                Tel.: [phone]
Universität Tübingen                   Fax.: [phone]
Zentrum für Datenverarbeitung          mail:  
michael.menge@...
Wächterstraße 76
72074 Tübingen

--
Horde mailing list - Join the hunt: http://horde.org/bounties/#horde
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: horde-unsubscribe@...