I want to provide a user with remote contact list (address book) that they can access and update from arbitrary clients on multiple devices. But I want to have zero knowledge of those contacts. Existing mechanisms (eg XMPP roster, CardDAV) store these details in the clear. Is there an existing mechanism for client-side encryption/decryption of an address book?

Notes (including security model):

  • The address book will be potentially be used by a variety of clients (XMPP, email, VoIP), so I am open to any mechanism/format.

  • I assume contacts could still be inferred from the routing logs of XMPP/email/other services. The server would need to be trusted on this anyway, so this is acceptable. It's the "permanent" storage of the full list of contact details that I'm wanting to address here.

  • I don't think such mechanism exists. At least I didn't see any in past.
    – Fis
    May 27, 2017 at 11:16
  • 1
    Could you be more specific what you are looking for? Would encrypted CardDAV files solve your problem?
    – Sjoerd
    May 27, 2017 at 16:54
  • @Sjoerd I've tried to give some use cases, but it is open ended -- encrypted CardDAV might work, is there a standardised way to do that?
    – lofidevops
    May 29, 2017 at 11:59
  • @Sjoerd I've also wondered about implementing a local, plaintext CardDAV server -- and storing and syncing that in an encrypted manner
    – lofidevops
    May 29, 2017 at 12:02
  • I assume that the "you" you refer to means your server? If so, the appropriate mechanism would be to encrypt client-side with a user supplied key/passcode. To be accessible to many service types would likely require some kind of local intermediary service to be run. May 29, 2017 at 20:33

1 Answer 1


The general problem here is storing structured data on an untrustworthy server. Implementations of zero-knowledge / zero-trust databases and homomorphic encryption are relatively uncommon, so even more specific solutions (like a zero-knowledge address book protocol) are unlikely. Instead you will need to implement on of the following:

  • Store an encrypted blob on the server, decrypt and manage it locally. The challenge here will be handling updates to the blob from multiple clients.

  • Use a normal relational database and encrypt sensitive fields (e.g. contact details). The challenge here is ensuring that inferences cannot be made from the encrypted data.

  • Use a zero-knowledge database framework like Crypton (code) or ZeroDB (code). The challenge here is finding a solution that is and will remain well-maintained.

You could then write a client-side module that matches the API of an existing CardDAV module (for example), but instead queries your secure storage, decrypts the result, and returns a plaintext CardDAV object.

Interesting reading: https://gist.github.com/thiloplanz/e1136a04b26c138c8225

  • ZeroDB: "This project is no longer actively maintained. If you'd like to become the maintainer, please let us know :)"
    – ThoriumBR
    Sep 21, 2020 at 14:07
  • And Crypton is not available on github either... Nor the site is up anymore.
    – ThoriumBR
    Sep 21, 2020 at 14:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .