Overview

A mail server stores its users’ messages in readable form, so anyone who can read the server’s storage can read the mail. That includes an administrator, an attacker who obtains a backup or a disk, and anyone who compromises the server. Encryption at rest protects the contents of a user’s stored messages against all of them.

The protection rests on public-key cryptography. Each user who wants it registers an OpenPGP public key or an S/MIME certificate with the server, and Stalwart encrypts every message for that user with the public key before storing it. A message encrypted this way can be decrypted only with the matching private key. That key never reaches the server: it stays with the user, in a mail client that supports OpenPGP or S/MIME, and only its holder can decrypt the messages.

Encryption at rest is optional and enabled per account. The server-wide settings decide whether users may turn it on, and each user then chooses a key and a cipher for their own account.

Scope of protection

The server encrypts the body of each message, including all attachments, and stores the message as an OpenPGP/MIME or S/MIME encrypted message. Messages that are already encrypted are stored unchanged.

The protection covers stored messages, not messages in transit through the server. Because a message is encrypted only when it is stored, the server sees it in plain text when it arrives. This has two consequences. Spam filtering, Sieve scripts and delivery rules run before encryption, so they work as usual. On the other hand, a server that is compromised while a message is received can read that message.

Some parts of a message stay readable to the server. The message headers, such as From, To, Subject and Date, stay in plain text, so that clients can list and sort messages without decrypting them. The envelope and the delivery logs are unaffected.

Search is limited to the headers. The search index is built from the stored message, so a search in the body or attachments of an encrypted message finds nothing, over JMAP and IMAP alike. Searches by sender, recipient or subject still work, because they use the headers.

The spam classifier learns from the text of messages, which an encrypted message no longer offers. An encrypted message therefore trains the classifier only when the account allows training on its plain text before encryption, through allowSpamTraining. Without that permission, the message is left out of training.

Encryption is not retroactive in either direction. It applies only to messages stored after it is enabled, and disabling it does not decrypt the messages stored while it was on.

Conditions for encryption

A message is encrypted at the moment it is stored, and the conditions depend on how the message reaches the mailbox.

A message received over SMTP or LMTP is encrypted when two conditions are met: the server-wide setting allows encryption, and the recipient account has enabled encryption with a registered key.

A message that a client stores itself over JMAP or IMAP, for example a copy of a sent message or a message moved from another account, needs one condition more. It is encrypted only when all three of the following are met:

• The server-wide encryptAtRest allows encryption.
• The server-wide encryptOnAppend is enabled.
• The account has enabled encryption of appended messages in its own settings.

Server-wide settings

The two server-wide switches are fields of the Email singleton. Its settings are found in the WebUI under Settings › Email › Defaults, Settings › Email › Encryption, Settings › Email › Limits, Settings › Email › Storage.

The encryptAtRest field decides whether users may turn on encryption at rest at all, and it is enabled by default. When it is disabled, no message is encrypted, whatever the account settings say.

The encryptOnAppend field extends encryption to messages appended over JMAP and IMAP, for the accounts that also enable it. It is disabled by default, and while it is disabled, appended messages are never encrypted.

The following settings allow both encryption at rest and the encryption of appended messages:

{
  "encryptAtRest": true,
  "encryptOnAppend": true
}

Users then register their keys and enable encryption for their own accounts, as described in Managing encryption.