Trying to figure out if Djigzo is "suitable" for our project

Gateway
1

Looking at doing a project and have played with Djigzo for a few hours
(On CentOS5) and am trying to figure out if it will work for our
needs. It is not looking promising. I'm using Thunderbird here in
all cases.

1) I can't seem to figure out how to get every user's SMIME cert to
every other user. Example: I've created johnny(a)bar.baz and
sammy(a)bar.baz. I created the internal CA, created a cert for both of
them and imported it. But, at that point, how do I send an encrypted
message between Johnny and Sammy? Without Sammy having Johnny's keys
and vice-versa, there isn't a way to encrypt the outgoing message. On
the certificates page, there is an option to "download all keys." But
aren't these the private keys? I wouldn't want every user to have
every user's private keys.

2) Is there any way to prevent Djigzo from DEcrypting incoming messages?

Essentially, here's what I'm looking for:
-- All messages in a user's mail folders are SMIME encrypted.
-- Any incoming mail that is SMIME encrypted for that user passes untouched.
-- Any incoming mail that is unencrypted is encrypted by Djigzo using
the user's own key.
-- Any outgoing mail that is encrypted is untouched
-- Any outgoing mail that is unencrypted is untouched.

I think that Djigzo ends up being total overkill in this situation?

···

--
Erik Jacobs
www.erikjacobs.com

2

Looking at doing a project and have played with Djigzo for a few
hours (On CentOS5) and am trying to figure out if it will work for
our needs. It is not looking promising. I'm using Thunderbird here
in all cases.

1) I can't seem to figure out how to get every user's SMIME cert to
every other user. Example: I've created johnny(a)bar.baz and
sammy(a)bar.baz. I created the internal CA, created a cert for both
of them and imported it. But, at that point, how do I send an
encrypted message between Johnny and Sammy? Without Sammy having
Johnny's keys and vice-versa, there isn't a way to encrypt the
outgoing message. On the certificates page, there is an option to
"download all keys." But aren't these the private keys? I wouldn't
want every user to have every user's private keys.

If you select the certificates and click "download keys" it will
download the keys but if you select "download certificates" it will only
download the certificates (without the keys). All the certificates for
all your internal users should be exchanged between clients. The easiest
way to do this is by selecting all the certificates for your users, and
then click "download certificates". This will give you a .p7b file
containing all certificates. This .p7b file can then be imported into
every desktop.

2) Is there any way to prevent Djigzo from DEcrypting incoming
messages?

If all users are external users (the default), then no email will be
decrypted. Incoming email is split into two paths, for internal
recipients email will be decrypted, for external recipients email will
be encrypted. If you do not make any domain or user an internal user, no
email will be decrypted.

Essentially, here's what I'm looking for: -- All messages in a user's
mail folders are SMIME encrypted. -- Any incoming mail that is SMIME
encrypted for that user passes untouched.
-- Any incoming mail that is unencrypted is encrypted by Djigzo
using the user's own key. -- Any outgoing mail that is encrypted is
untouched -- Any outgoing mail that is unencrypted is untouched.

I think that Djigzo ends up being total overkill in this situation?

I have been thinking about such a use case as well because it can be
used to store all email encrypted in your local mailbox. This is kind of
different from the typical use case of the Djigzo gateway. If you make
sure that every user is an external user, this should work since all
incoming email for some internal user will be encrypted if it is not
already encrypted (if setup to encrypt all email for certain users).

How are your internal users going to send encrypted email to each other?
Using the S/MIME functionality of the email client?

Kind regards,

Martijn Brinkers

···

On 11/24/2011 05:07 AM, Erik Jacobs wrote:

3

Djigzo is used for encrypting email between people in different domains,
like between companies or organizations. Inside, the mail is
unencrypted. The reason for this is that users generally find encryption
and decryption way to complicated, even when using Thunderbird or
Outlook with pre-installed keys. I am not making this up, both Martijn
and I have ample experience in this area. So yes, if all you want to use
Djigzo for is exchange of keys between your users, you will not use the
core features of Djigzo.

We have experience with building plugins for Outlook and other mail
clients that support encryption and signing in combination with Djigzo,
where keys are exchanged automatically based on user and company
policies. However, in our limited development budget, this currently is
not a priority.
Hope this helps...

kind regards
Christine

···

On 11/24/2011 05:07 AM, Erik Jacobs wrote:

1) I can't seem to figure out how to get every user's SMIME cert to
every other user.