Re: Asymmetric file encryption… use gnupg from ports or is there something else?
On Wed, May 10, 2023 at 01:41:47PM +1000, Stuart Longland wrote: > delivery. I've certainly coaxed Taylor UUCP to work over SSH in the > past, and it does work just fine. Not sure if OpenBSD has a built-in > UUCP, but that is an option. It'd solve my immediate problem… but I > figure if they're going to sit there any length of time, I might as > well protect them from prying eyes if possible. > > The aim here is not to defend against every possible attack, it's to > defend against the most probable ones and keep people honest. Mail is most likely leaking while in transit or sitting on servers you have no control over. So putting lots of effort into protecting mail on your backup MX might not make much of a difference in practice. softraid CRYPTO or RAID1C works well for servers. It doesn't protect files if someone gains access to the live system, or gains access to decrypted blocks or volume key in VM memory space if you're running in a VM. But at least the underlying disks or disk images will be unreadable. In a VM in particular it's difficult to reliably protect data from the host system so you'll have to trust the host. You need a way to enter a passphrase at boot so this requires bootloader access on the console. And a reboot happening for any reason requires manual intervention. I am fine with those restrictions and it's been worksing well for me on servers I run. In any case, you could as well encrypt invididual files to make them unreadable to people who manage to peek into the decrypted softraid volume somehow. For invidiual files I cannot think of tools that do this and have great UIs. Maybe indeed try to script something around gnupg or perhaps openssl(1). No good options come to mind... Or accept that you'll have to use a volume to be somehow unlocked/locked on demand and take a look at the security/encfs and security/veracrypt ports, and vnconfig(8) -K. Nesting softraid volumes should be avoided.
Re: Asymmetric file encryption… use gnupg from ports or is there something else?
On Tue, 9 May 2023 13:36:07 -0600 Zack Newman wrote: > Personally, I don't think this makes all that much sense. E-mail is not > very secure. If you can't guarantee communication is E2EE, then this seems > like false security/privacy to me. Not only does the other recipient > likely use a service like Gmail which means your communication is in > Google's hands; but unless you strictly enforce encryption in transit- > most MTAs only use _opportunistic_ encryption-every device your e-mail > traversed possibly has access to the content as well. This is why > applications like Signal are gaining popularity especially in the > crypto/infosec crowd. Well, this is true… for the ultimate guarantee, you use end-to-end encryption tools like S/MIME and OpenPGP. This is a more "can it be done" exercise. If it proves to "not be that secure", then so be it. It's a case of nothing ventured, nothing gained. > Last, if you are worried about the "remote server"; then why not just > host the MTA at your house along with your "home mail server"? If you check the MX records of my present email domain, you'll see that's exactly what I'm doing. The email is hosted at my house (on a Linux VM) behind an OpenBSD router/firewall which is directly connected to this country's glorious NBN. Now, those who know anything about Australia's NBN will know that it is utterly useless in a power outage and can have bouts of unreliability. (I run HFC NBN. NTD is on back-up 12V power, but the infrastructure in the street is not, so in a black-out, the NTD sits there blinking useless asking: "where's my network?!?!") If the NBN goes down, or I'm doing maintenance… MX is down and out. If I'm away from home when it goes down, it might be days before I can get back there to fix it. I'd like my emails to just safely sit somewhere under my control until they can be collected. I could just store them on the server clear-text and use UUCP for delivery. I've certainly coaxed Taylor UUCP to work over SSH in the past, and it does work just fine. Not sure if OpenBSD has a built-in UUCP, but that is an option. It'd solve my immediate problem… but I figure if they're going to sit there any length of time, I might as well protect them from prying eyes if possible. The aim here is not to defend against every possible attack, it's to defend against the most probable ones and keep people honest. Regards, -- Stuart Longland (aka Redhatter, VK4MSL) I haven't lost my mind... ...it's backed up on a tape somewhere.
Re: Asymmetric file encryption… use gnupg from ports or is there something else?
On 2023-05-09, Stuart Henderson wrote: Ed25519 is used for signing not encrypting. But Ed25519 keys can be converted and used for encryption; "age" has convenience support for doing this with Ed25519 ssh keys, and might generally be something that works for your use case. It's not in base though. https://words.filippo.io/using-ed25519-keys-for-encryption/ Another possibility is libsodium's crypto_box API but will need more self-assembly as afaik there's no standard CLI tool using this. That doesn't meet their requirements. They want to avoid storing any private key material on the "remote server", and Diffie-Hellman (which is what X25519 is based on) requires access to the private key. Personally, I don't think this makes all that much sense. E-mail is not very secure. If you can't guarantee communication is E2EE, then this seems like false security/privacy to me. Not only does the other recipient likely use a service like Gmail which means your communication is in Google's hands; but unless you strictly enforce encryption in transit- most MTAs only use _opportunistic_ encryption-every device your e-mail traversed possibly has access to the content as well. This is why applications like Signal are gaining popularity especially in the crypto/infosec crowd. Last, if you are worried about the "remote server"; then why not just host the MTA at your house along with your "home mail server"? Simply configure the "remote server" to be a router that routes traffic through a WireGuard tunnel to your house. Then your e-mails will be "at rest" at your house. As an added benefit, you can route local traffic destined to your MTA to be routed directly to your server and avoid the traffic from ever leaving your house. Zack
Re: Asymmetric file encryption… use gnupg from ports or is there something else?
On 2023-05-08, Stuart Longland wrote: > Silly question… is there a tool for encrypting files with asymmetric > keys on OpenBSD? I'm aware of GnuPG in ports, and I'm fine with using > that, however I'm curious to know what other options there are out > there, especially options that are part of the base system. > > I know OpenSSL (and likely LibreSSL) can do RSA for this purpose, > although its CLI is more of a debugging tool than an actual encryption > tool. to be fair, gpg's CLI seems more like a debugging tool too ;) >I'd also like to use ECC keys (ideally ED25519) for future > proofing, since RSA is getting quite long in the tooth now. Ed25519 is used for signing not encrypting. But Ed25519 keys can be converted and used for encryption; "age" has convenience support for doing this with Ed25519 ssh keys, and might generally be something that works for your use case. It's not in base though. https://words.filippo.io/using-ed25519-keys-for-encryption/ Another possibility is libsodium's crypto_box API but will need more self-assembly as afaik there's no standard CLI tool using this.
Re: Asymmetric file encryption… use gnupg from ports or is there something else?
On Tue, May 09, 2023 at 09:21:03AM +1000, Stuart Longland wrote: > Hi all, > > Silly question… is there a tool for encrypting files with asymmetric > keys on OpenBSD? I'm aware of GnuPG in ports, and I'm fine with using > that, however I'm curious to know what other options there are out > there, especially options that are part of the base system. You may want to take a look at enchive (http://nullprogram.com/blog/2017/03/12/) It's not in base, but it's self-contained and tiny.
