Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider.

  • Server side: PHP or Python based Web application implementing CardDav & CalDav
  • Client side: Desktop E-mail client & mobile client with CardDav & CalDav support


Client 01 --> WRITE data (data encryption)--> CalDav/CardDav Server

Client 01 <-- READ data (data decryption)<-- CalDav/CardDav Server

Client 02 --> WRITE data (data encryption)--> CalDav/CardDav Server

Client 02 <-- READ data (data decryption)<-- CalDav/CardDav Server

The purpose is to ensure confidentiality of the data (contacts, calendar events) on the server in order to keep private information secure from potential eyes-dropping. The goal is also that the data on the server can be accessed by multiple clients AND users.

Do you know if such a thing actually exists & can you provides examples of implementation?

share|improve this question
Cryptree might be an interesting implementation but is a filesystem, not an intermediary layer between regular plain text CardDav/CalDav client & server: I didn't found any FOSS library/API so far (the paper is also too "high-level"). Cryptree design is supposedly used by the Wuala cloud provider. Another point: The implementation of a client-side encryption for CalDav/CardDav data is discussed here: I'm still looking for ressources on that topic. @Xander,@Gilles,Can you remove the "on hold" status of that question please? – g0lem Aug 30 '13 at 13:49

No, this is impossible.

For CalDAV and CardDAV to work the server needs to be able to see the contents of the file in order to respond to the WebDAV/CalDAV/CardDAV methods REPORT and PROPFIND and similar.

share|improve this answer
I was thinking about a design that would allow to send/receive the values of the CalDav/CardDav properties in a ciphered format. Thanks for pointing that, indeed, encryption at the file level is a no go... – g0lem Jan 28 '14 at 12:12
That doesn't help because the server needs to be able to read the dates to respond to date range queries. The only way to do something like this is to download all of the data and query it on the local device. – Ben Jan 28 '14 at 12:32

You can encrypt/decrypt using GunPG on both sides

for the server side (php) you can use this PECL extension :

for the client side you OpenPGP.js :

share|improve this answer
This would only help over-the-wire security (which can already be done easily using SSL). The question asks «so that they couldn't be compromised even by the hosting provider» and decrypting the data on the server automatically defeats the purpose. – Caleb Aug 22 '14 at 8:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.