docs/src/encryption.md

Sat, 05 Aug 2017 10:57:47 +0200

author
Mike Becker <universe@uap-core.de>
date
Sat, 05 Aug 2017 10:57:47 +0200
changeset 279
f0f24da5f920
parent 274
5577d3eae04c
child 281
ddb5e8f2a43d
permissions
-rw-r--r--

refines copy.md

273
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
1 Encryption
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
2 ==========
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
3
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
4 The davutils programs have an integrated client-side encryption feature, that allows you to encrypt and decrypt on the fly with AES256 or AES128. To use this feature, the server **must** support WebDAV dead properties.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
5
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
6 The tools support both, encryption of the resource content and encryption of the resource name. Each resource is encrypted separately. With activated name encryption, the actual resource name is random but the name used by the client is stored encrypted in WebDAV properties. This means, an attacker can see the directory structure and the file length, but can't see which files have the same name.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
7
274
5577d3eae04c dav-sync command documentation complete
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 273
diff changeset
8 To enable encryption a key must be configured in `$HOME/.dav/config.xml`. A key must have a unique name. To access encrypted resources, all clients must configure the same key with the same name. Currently a key can only be loaded from a file and not generated from a password.
273
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
9
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
10 A configuration for a key looks like:
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
11
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
12 <key>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
13 <name>mykey1</name>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
14 <file>keys/mykey1</file>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
15 </key>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
16
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
17 The file path must be relative to `$HOME/.dav/`. In this example the file `$HOME/.dav/keys/mykey1` is loaded.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
18
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
19 To generate a key use **`dd`** on unix like systems.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
20
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
21 dd if=/dev/random of=mykey1 bs=32 count=1
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
22
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
23 After a key is configured, you can enable encryption/decryption in two ways. You can use the dav option **`-c`** to enable encryption and specify your key with the **`-k`** option. The alternative is to enable encryption by default for a repository in the config.xml file.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
24
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
25 <repository>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
26 <name>myrepo</name>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
27 <url>http://example.com/webdav/</url>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
28
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
29 <default-key>mykey1</default-key>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
30 <full-encryption>true</full-encryption>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
31 </repository>
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
32
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
33 See [Configuration][1] for details.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
34
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
35 [1]: ./configuration.html
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
36
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
37 Internals
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
38 ---------
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
39
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
40 When a resource is encrypted, some crypto properties (namespace: http://davutils.org/) are set for the resource.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
41
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
42 - crypto-key: Contains the name of the key used for encryption. The presence of this property indicates that the resource is encrypted
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
43 - crypto-hash: A Hash of the cleartext, encrypted and base64 encoded
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
44 - crypto-name: The name of the resource, encrypted and base64 encoded. This property is not used if name encryption is disabled.
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
45
c743721d566f more documentation
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 265
diff changeset
46

mercurial