Skip to content

Draft: Add preliminary Autocrypt support.

Justus Winter requested to merge teythoon/mailman:autocrypt into master

This adds partial support for opportunistic encryption using Autocrypt (see https://autocrypt.org).

Specifically, we ingest Autocrypt headers on incoming mails, and track Autocrypt state per address. When sending mails, the Autocrypt recommendation is computed. If Autocrypt signals to enable encryption, we encrypt the outgoing mail.

For the OpenPGP operations, and for parsing the Autocrypt header, a point solution implemented in Rust on top of Sequoia-PGP is used. This is the recommended way to use Sequoia from other languages. By identifying the set of required OpenPGP operations, we can implement them in Rust, enjoying the rich Sequoia API, and expose robust and simple to use functions to the application logic.

The glue code is small and straight forward. Tooling for developers and packagers exist and is really good (maturin).

What's missing is being able to decrypt incoming mails, and having a configurable policy about what should happen to received mails that were encrypted. Several policies come to mind, depending on the list's use case and threat model:

  • Opportunistic: encrypt if the subscriber has a cert, send plain text otherwise.
  • Drop and notify: encrypt if the subscriber has a cert, send a notification that an encrypted mail has been sent and wasn't delivered due to not having a cert otherwise.
  • Drop and not notify: encrypt if the subscriber has a cert, do nothing otherwise.
  • Require subscribers to have a cert, reject them otherwise.

I want to get a feel for:

  • Is this something you'd like to see in Mailman?
  • Are you okay with having a custom-built dependency for that feature? (I'd imagine simply deactivating the feature if it isn't available.)

Merge request reports