This makes it very easy to exchange new key(s) if a user loses access to the key but also makes the protocol much more susceptible to man-in-the-middle attacks than clean TOFU. Key exchange is during the initial handshake and valid or invalid keys of peers may be replaced anytime later without any user interaction or verification. In contrast, Autocrypt completely resigns on any kind of key verification. Traditional OpenPGP applications should display a noticeable warning if keys are not verified either manually or by a web of trust method before use. Encryption of messages between Autocrypt-capable clients can be enabled without further need of user interaction. Security model Īutocrypt is guided by the idea of opportunistic security from RFC 7435 but implementing something much less secure than a trust on first use (TOFU) model. This ensures that a reply to a message can be encrypted without any further complications or work by the user. When a message is encrypted to a group of receivers, keys are also automatically sent to all receivers in this group. No support is required from email providers other than preserving and not manipulating the Autocrypt specific header fields. This information is not signed or verified in any way even if the actual message is encrypted and verified. This is done by including the key material and encryption preferences in the header of each email, which allows encrypting any message to a contact who has previously sent the user email. Īutocrypt-capable email clients transparently negotiate encryption capabilities and preferences and exchange keys between users alongside sending regular emails. It is implemented on top of OpenPGP replacing its complex key management by fully automated unsecured exchange of cryptographic keys between peers. Version 1.0 of the Autocrypt specification was released in December 2017 and makes no attempt to protect against MITM attacks. JSTOR ( December 2019) ( Learn how and when to remove this template message)Īutocrypt is a cryptographic protocol for email clients aiming to simplify key exchange and enabling encryption.Unsourced material may be challenged and removed. Please help improve this article by adding citations to reliable sources. This article needs additional citations for verification.
0 Comments
Leave a Reply. |