Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider.

  • Server side: PHP or Python based Web application implementing CardDav & CalDav
  • Client side: Desktop E-mail client & mobile client with CardDav & CalDav support

Example

Client 01 --> WRITE data (data encryption)--> CalDav/CardDav Server

Client 01 <-- READ data (data decryption)<-- CalDav/CardDav Server

Client 02 --> WRITE data (data encryption)--> CalDav/CardDav Server

Client 02 <-- READ data (data decryption)<-- CalDav/CardDav Server

The purpose is to ensure confidentiality of the data (contacts, calendar events) on the server in order to keep private information secure from potential eyes-dropping. The goal is also that the data on the server can be accessed by multiple clients AND users.

Do you know if such a thing actually exists & can you provides examples of implementation?

share|improve this question
    
Cryptree might be an interesting implementation but is a filesystem, not an intermediary layer between regular plain text CardDav/CalDav client & server: goo.gl/wQH39P. I didn't found any FOSS library/API so far (the paper is also too "high-level"). Cryptree design is supposedly used by the Wuala cloud provider. Another point: The implementation of a client-side encryption for CalDav/CardDav data is discussed here: goo.gl/nDmftz. I'm still looking for ressources on that topic. @Xander,@Gilles,Can you remove the "on hold" status of that question please? –  g0lem Aug 30 '13 at 13:49

2 Answers 2

No, this is impossible.

For CalDAV and CardDAV to work the server needs to be able to see the contents of the file in order to respond to the WebDAV/CalDAV/CardDAV methods REPORT and PROPFIND and similar.

share|improve this answer
    
I was thinking about a design that would allow to send/receive the values of the CalDav/CardDav properties in a ciphered format. Thanks for pointing that, indeed, encryption at the file level is a no go... –  g0lem Jan 28 at 12:12
    
That doesn't help because the server needs to be able to read the dates to respond to date range queries. The only way to do something like this is to download all of the data and query it on the local device. –  Ben Jan 28 at 12:32

You can encrypt/decrypt using GunPG on both sides

for the server side (php) you can use this PECL extension : http://www.php.net//manual/fr/book.gnupg.php

for the client side you OpenPGP.js : http://openpgpjs.org/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.