I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider.

  • Server side: PHP or Python based Web application implementing CardDav & CalDav
  • Client side: Desktop E-mail client & mobile client with CardDav & CalDav support


Client 01 --> WRITE data (data encryption)--> CalDav/CardDav Server

Client 01 <-- READ data  (data decryption)<-- CalDav/CardDav Server

Client 02 --> WRITE data (data encryption)--> CalDav/CardDav Server

Client 02 <-- READ data  (data decryption)<-- CalDav/CardDav Server

The purpose is to ensure confidentiality of the data (contacts, calendar events) on the server in order to keep private information secure from potential eyes-dropping. The goal is also that the data on the server can be accessed by multiple clients AND users.

Do you know if such a thing actually exists & can you provides examples of implementation?

  • Cryptree might be an interesting implementation but is a filesystem, not an intermediary layer between regular plain text CardDav/CalDav client & server: goo.gl/wQH39P. I didn't found any FOSS library/API so far (the paper is also too "high-level"). Cryptree design is supposedly used by the Wuala cloud provider. Another point: The implementation of a client-side encryption for CalDav/CardDav data is discussed here: goo.gl/nDmftz. I'm still looking for ressources on that topic. @Xander,@Gilles,Can you remove the "on hold" status of that question please?
    – g0lem
    Commented Aug 30, 2013 at 13:49

3 Answers 3


No, this is impossible.

For CalDAV and CardDAV to work the server needs to be able to see the contents of the file in order to respond to the WebDAV/CalDAV/CardDAV methods REPORT and PROPFIND and similar.

  • I was thinking about a design that would allow to send/receive the values of the CalDav/CardDav properties in a ciphered format. Thanks for pointing that, indeed, encryption at the file level is a no go...
    – g0lem
    Commented Jan 28, 2014 at 12:12
  • 1
    That doesn't help because the server needs to be able to read the dates to respond to date range queries. The only way to do something like this is to download all of the data and query it on the local device.
    – Ben
    Commented Jan 28, 2014 at 12:32

You can encrypt/decrypt using GunPG on both sides

for the server side (php) you can use this PECL extension : http://www.php.net//manual/fr/book.gnupg.php

for the client side you OpenPGP.js : http://openpgpjs.org/

  • This would only help over-the-wire security (which can already be done easily using SSL). The question asks «so that they couldn't be compromised even by the hosting provider» and decrypting the data on the server automatically defeats the purpose.
    – Caleb
    Commented Aug 22, 2014 at 8:06

Based on the needs, it appears the best approach would be on the client side to encrypt and decrypt data. Or, have corresponding files identifying content that points to the correct data once decrypted.

On an iOS device, you would need certain data to not be encrypted so things can be searched on the device (using Spotlight Search for instance). Is there a way to leverage that search index to provide data for requests or to compare to response to server requests?

  • 1
    welcome - this answer is generic in nature, and it's not clear to me how it pertains to the specific technology mentioned in the question; you could definitely improve this answer by explaining to readers how your solution provides for card- and cal-dav e2ee
    – brynk
    Commented Dec 21, 2022 at 2:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .