Autocrypt Explained

Autocrypt is a cryptographic protocol for email clients aiming to simplify key exchange and enabling encryption. Version 1.0 of the Autocrypt specification was released in December 2017 and makes no attempt to protect against MITM attacks.^[1] It is implemented on top of OpenPGP replacing its complex key management by fully automated exchange of cryptographic keys between peers .

Method

Autocrypt-capable email clients transparently negotiate encryption capabilities and preferences and exchange keys between users alongside sending regular emails. This is done by including the key material and encryption preferences in the header of each email, which allows encrypting any message to a contact who has previously sent the user email. This information is not signed or verified in any way even if the actual message is encrypted and verified.

No support is required from email providers other than preserving and not manipulating the Autocrypt specific header fields.

When a message is encrypted to a group of receivers, keys are also automatically sent to all receivers in this group. This ensures that a reply to a message can be encrypted without any further complications or work by the user.

Security model

Autocrypt is guided by the idea of opportunistic security from RFC 7435 but implementing something much less secure than a trust on first use (TOFU) model. Encryption of messages between Autocrypt-capable clients can be enabled without further need of user interaction. Traditional OpenPGP applications should display a noticeable warning if keys are not verified either manually or by a web of trust method before use. In contrast, Autocrypt completely resigns on any kind of key verification. Key exchange is during the initial handshake and valid or invalid keys of peers may be replaced anytime later without any user interaction or verification. This makes it very easy to exchange new key(s) if a user loses access to the key but also makes the protocol much more susceptible to man-in-the-middle attacks than clean TOFU. The underlying OpenPGP implementation makes it often possible for the user to perform manual out of band key verification, however by design users are never alerted if Autocrypt changed the keys of peers.

Autocrypt tries to maximize the possible opportunities for encryption, but is not aggressive about encrypting messages at all possible opportunities. Instead, encryption is only enabled by default if all communicating parties consent, allowing users to make themselves available for encrypted communication without getting in the way of their established workflows.^[2]

Man-in-the-middle attacks are not preventable in this security model, which is controversial.^[3]

Any attacker who can send emails with forged sender-address can cause encryption keys to be replaced by keys of his choice and/or deliberately turn off encryption.^[4]

Technical details

Autocrypt uses the established OpenPGP specification as its underlying data format. Messages are encrypted using AES and RSA keys, with a recommended RSA key length of 3072 bits. These mechanisms are chosen for maximum compatibility with existing OpenPGP implementations. There are plans for moving to smaller Elliptic-curve keys when support is more widely available.^[5]

The Autocrypt header field features a tag=value format common to several mechanisms (for example dkim), where the keydata tag contains the public key. It is similar to an armored key export, except that it misses the -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK----- lines.^[6]

For example:Autocrypt: addr=[e-mail]; prefer-encrypt=mutual; keydata= mDMEXEcE6RYJKwYBBAHaRw8BAQdArjWwk3FAqyiFbFBKT4TzXcVBqPTB3gmzlC/Ub7O1u12 0F2FsaWNlQGF1dG9jcnlwdC5leGFtcGxliJYEExYIAD4WIQTrhbtfozp14V6UTmPyMVUMT0 fjjgUCXEcE6QIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDyMVUMT0fjj kqLAP9frlijw BJvA+HFnqCZcYIVxlyXzS5Gi5gMTpp37K73jgD/VbKYhkwk9iu689OYH4K 7q7LbmdeaJ+RX88Y/ ad9hZwy4OARcRwTpEgorBgEEAZdVAQUBAQdAQv8GIa2rSTzgqbXCp DDYMiKRVitCsy203x3sE9+eviIDAQgHiHgEGBYIACAWIQTrhbtfozp14V6UTmPyMVUMT0fj jgUCXEcE6QIbDAAKCRDyMVUMT0fjjlnQAQDFHUs6TIcxrNTtEZFjUFm1M0PJ1Dng/cDW4xN 80fsn0QEA22Kr7VkCjeAEC08VSTeV+QFsmz55/lntWkwYWhmvOgE=

Support

• Kontact since version 21.04.^[7]
• Delta Chat messenger from Version 0.9.2.^[8]
• K-9 Mail Android mail-app has support since Version 5.400^[9] (reportedly broken until version 5.717^[10]).
• SnappyMail webmail from Version 2.34.0.^[11]
• Thunderbird partially supports AutoCrypt since version 78. Thunderbird generates, sends and receives AutoCrypt headers, but does not automatically install received public keys. User action is still required to approve and install a sender's public key.^[12]
• The German email provider Posteo supports AutoCrypt, and improves its security by also cryptographically signing outbound Autocrypt header data via DKIM.^[13]
• No longer functional: Autocrypt extension in Thunderbird.^[14]
• No longer functional: Thunderbird extension Enigmail since version 2.0.^[15]

Further reading

• Autocrypt - in: Bertram, Linda A. / Dooble, Gunther van / et al. (Eds.): Nomenclatura: Encyclopedia of modern Cryptography and Internet Security - From AutoCrypt and Exponential Encryption to Zero-Knowledge-Proof Keys, 2019, .
• OpenPGP
• Transformation of Cryptography: Fundamental concepts of Encryption^[16]
• The New Era Of Exponential Encryption: - Beyond Cryptographic Routing^[17]

External links

• Autocrypt Website (engl.)
• Autocrypt 1.0 Spezifikation (engl.)
• Autocrypt mailing list
• Autocrypt github repo
  • Web site: Einfache Mail-Verschlüsselung: PGP-Helfer Autocrypt in Version 1.0 vorgestellt. 2018-04-24. iX. German.

References

1. Web site: Autocrypt FAQ. autocrypt.org. 2019-12-08.
2. Web site: OpenPGP Considerations, Part III: Autocrypt and Encryption by Default K-9 Mail. k9mail.github.io. en. 2018-04-28.
3. Web site: Bye-bye Enigmail!: OpenPGP wird in Thunderbird integriert - Golem.de. www.golem.de. German. 2019-12-23.
4. Web site: Autocrypt FAQ — What about spammers accidentally downgrading encryption?. autocrypt.org. 2019-12-01.
5. Web site: Autocrypt FAQ — Why RSA3072 and 25519 only later?. autocrypt.org. 2018-04-29.
6. Web site: The Autocrypt Header. autocrypt.org. 2024-05-29.
7. Web site: KDE Gear 21.04 released. 2021-04-22. Paul Brown, Carl Schwan, and Áron Kovács. 22 April 2021.
8. Web site: Delta Chat v0.9.2 feat. Autocrypt Level 1. 2018-04-26.
9. Web site: 5.4 Release K-9 Mail. 2018-04-24. 21 December 2018. https://web.archive.org/web/20181221182722/https://k9mail.github.io/2018/01/07/5.4-Release.html. dead.
10. Web site: K-9 mail fails to encrypt emails by default, even with "Autocrypt mutual mode" enabled. GitHub. 2021-02-27.
11. Web site: Releases: the-djmaze/snappymail. . 2024-02-17.
12. Web site: 26 June 2022 . Does Thunderbird support Autocrypt? . 2024-06-25 . Mozilla Support.
13. Web site: 18 December 2017 . Vereinfachte E-Mail-Verschlüsselung mit Autocrypt- und OpenPGP-Header . 2018-04-24 . Posteo.de . German . Our contribution to security: We additionally secure the key exchange with Autocrypt with digital signatures (DKIM). This is not currently provided as standard with Autocrypt. Our provider-side DKIM signature ensures that public keys cannot be manipulated unnoticed during transport. We also sign Autocrypt headers that your local email program may add with DKIM. The signature is applied if the sender matches the mailbox. We save the key exchange with Autocrypt additionally with digital signatures (DKIM). This is not yet provided by default at Autocrypt. Our provider-side DKIM signing ensures that public keys cannot be manipulated unnoticed on transport. We also sign autocrypt header, which your local email program may add, with DKIM. The signature is made when the sender matches the mailbox..
14. Web site: Autocrypt. addons.thunderbird.net. en-US. 2019-10-08.
15. Web site: Enigmail - 2018-03-25 Enigmail v2.0 released. 2018-04-24. Patrick Brunschwig.
16. Book: Transformation of Cryptography: Fundamental concepts of Encryption, Milestones, Mega-Trends and sustainable Change in regard to Secret Communications and its Nomenclatura. Bertram. Linda A.. Dooble. Gunther van. 2019-07-31. BoD – Books on Demand. 978-3-7494-5074-9. en.
17. Book: The New Era Of Exponential Encryption: - Beyond Cryptographic Routing with the Echo Protocol [Paperback]]. Gasakis. Mele. Schmidt. Max. 2019-01-08. BoD – Books on Demand. 978-3-7481-5886-8. en.