Re: Feature suggestion. Indexing encrypted mail?

[Guyzmo <guyzmo+notmuch@m0g.net>]

Hi!

On Sat, Apr 05, 2014 at 12:09:32PM -0700, Jameson Graef Rollins wrote:
> On Sat, Apr 05 2014, David Bremner <david@tethera.net> wrote:
> > john.wyzer@gmx.de writes:
> >> Would it be possible to add the configurable option to also decrypt
> >> encrypted messages on the fly while indexing to make them searchable,
> >> too?
> > As far I understand an attacker could reconstruct the message from the
> > index, so one question is whether the extra complexity in notmuch is
> > worth the minimal extra security over decrypting on delivery and storing
> > plaintext on the (presumably encrypted) disk. Of course decrypting on
> > delivery may be inconvenient (or impossible). I have CCed the two people
> > who have implemented most of the crypto related stuff in notmuch so they
> > can comment.
> Indexing encrypted email is a bit of a foot-gun, since, as David
> mentions, it is apparently possible to reconstruct encrypted messages
> From the index.  It therefore needs to be approached with care.
> 
> I think decrypting on "delivery" (or mail fetch or whatever) sounds
> difficult and unwieldy.  In either event, it seems out of the scope of
> notmuch.  If a user figured out how to have that done, no changes to
> notmuch would be needed afaict.
[…]

    I indeed agree with this view, and I think the best process would be
to have the MUA decrypt and index an encrypted mail when the  user wants
it to be indexed. So the user do not get really  highly  secret messages
disclosable by the index, and for the others take that kind of risk.

    That way you wouldn't need to keep the secret in  the  gpg-agent for
too long, and/or need a password for an automated process.

my two cents,

-- 
Guyzmo