MIME Magic

In the upcoming release for Phosphorus Five, I have given a lot of attention to everything related to security, which also for obvious reasons includes how P5 creates MIME messages, and are using PGP cryptography to encrypt MIME messages. The MIME features of Phosphorus Five can be found in the project called “p5.mime”, and internally it is using MimeKit. This implies among other things that parsing and creating MIME messages in Phosphorus Five is fast as greased lightning. I have previously tested its capacity myself, and I were able to create a multipart MIME envelope containing 5,000 (small) images, encrypt the whole thing, and save it to disc – And the operation was over after 10-12 seconds on my MacBook Air from 2016, and it spent almost no memory. Decrypting the MIME envelope, and re-creating its files, also took roughly 10-12 seconds.

The sheer speed of MimeKit, and its intelligent usage of streams, hence allows us to use MIME “outside the box”. One of the things I’ll implement wrappers for probably quite soon, is the ability to invoke and handle PGP encrypted MIME web services. This has a lot of interesting advantages, such as eliminating “Man In The Middle” attacks, by expecting the web service invocation to be cryptographically signed, by a trusted client’s private PGP key. In addition to that since it’s integral to the PGP standard to actually compress the resulting encrypted content, also reducing bandwidth consumption. In addition to (of course) making a potential “Main In The Middle” completely in the dark as to what is actually transferred between the web service endpoint, and its clients. And by combining this features with lambda web services, this opens up for a whole range of interesting use cases and new approaches to solving your problems.

Notice, I want to emphasise that some of the features I describe below, are still not yet released, but will be available in Phosphorus Five as of from version 8.4 and up. If you wish to see if version 8.4 has been released, you can check out my GitHub project here. If you want to play with these features after 8.4 is released, you can use “Hypereval” and paste in the code examples I have included below …

MIME is one of those internet acronyms, and it means “Multi-purpose Internet Message Exchange”. Even though most people simply knows it indirectly through their email software, it is highly useful for a *lot* of other scenarios too, and literally a “multi purpose” format. Which I intend to illustrate with some examples at the bottom of this article. However, first let’s try to learn its basics, before we go “all Ninja” with it …

Creating a MIME envelope

To create a simple MIME envelope with Phosphorus Five is dead simple. Use for instance the [p5.mime.create] Active Event, pass in your MIME entities, and VOILA! Below is a minimalistic example illustrating this. Yet again, use “Hypereval” for the code examples in this article.

p5.mime.create
  text:plain
    content:This is your MIME content!

The above results in the following.

p5.mime.create
  result:@"Content-Type: text/plain

This is your MIME content!"

If you want to create multiple MIME messages, you can pass in multiple MIME entities, like the following illustrates.

p5.mime.create
  text:plain
    content:This is your MIME content!
  text:plain
    content:This is your second MIME content!

You can also provide expressions, leading to one or more nodes declaring your MIME envelopes.

.mime
  text:plain
    content:This is your MIME content!
  text:plain
    content:This is your second MIME content!
p5.mime.create:x:/@.mime/*

The above would result in the following.

.mime
  text:plain
    content:This is your MIME content!
  text:plain
    content:This is your second MIME content!
p5.mime.create
  result:@"Content-Type: text/plain

This is your MIME content!"
  result:@"Content-Type: text/plain

This is your second MIME content!"

Persisting MIME envelopes to disc

If you’d rather persist your MIME envelopes to disc, you can use [p5.mime.save]. This event requires a filename as its main argument, and expects the user to have write access to the filename you supply. Below is an example of using it.

p5.mime.save:/foo.mime
  text:plain
    content:This is your MIME content!

The above code will create a file named “foo.mime” in your server’s root folder, containing your MIME envelope. Notice, you can supply multiple MIME entities to your [p5.mime.save] event. However, this will simply persist your MIME envelopes consecutively into the same file, which is highly likely *not* what you want. Hence; “Multiparts to the rescue.”

The whole idea with MIME is that it’s actually a tree structure, or a graph object. And by creating a “multipart” MIME envelope, you can wrap multiple MIME entities into the same MIME envelope. Below is an example of creating a file on disc with a multipart containing two text MIME entities.

p5.mime.save:/foo.mime
  multipart:mixed
    text:plain
      content:This is your MIME content!
    text:plain
      content:This is your OTHER MIME content!

The above will result in a file resembling the following.

Content-Type: multipart/mixed; boundary="=-nqxGFPSK1IvoMUwBVqzf2g=="

--=-nqxGFPSK1IvoMUwBVqzf2g==
Content-Type: text/plain

This is your MIME content!
--=-nqxGFPSK1IvoMUwBVqzf2g==
Content-Type: text/plain

This is your OTHER MIME content!
--=-nqxGFPSK1IvoMUwBVqzf2g==--

The above is actually a tree structure, with one “multipart” containing two “text” parts. This feature of MIME allows us to embed multiple objects into a single MIME “envelope”.

Notice though that since the main argument in [p5.mime.save] is the path to your file, you cannot supply an expression leading to your MIME envelopes the way we did with [p5.mime.create]. You can though supply a path as an expression. Notice also that if you use [p5.mime.save], your MIME envelopes are serialised directly into the stream, never consuming much memory on your server, allowing you to create MIME envelopes in the gigabyte size, without exhausting your server’s resources. You can of course nest as many “multipart” MIME entities as you wish, creating entire tree structures, encrypting and cryptographically signing parts of your MIME entities, with different PGP keys too – If you wish …

Encrypting your MIME envelopes

This is where it gets really interesting. The PGP features of MimeKit, and hence Phosphorus Five, is really quite stunning. If we wanted to encrypt the above multipart for instance, we could easily do so with a couple of additional lines of code.

Background; When you installed Phosphorus Five and started it for the first time, Phosphorus Five would spend some 20-40 seconds during the initial installation process. This was the place where you had to choose a “root” password, and supply your name and email address. The reasons for this, is because it will create a PGP key pair, which is used for encrypting your “auth” file. This PGP key is your server’s PGP key pair, and can (obviously) also be used for other things too. Such as for instance encrypting your MIME envelopes. Below is an example of encrypting our “multipart” from above. To evaluate this code, you’ll have to replace the [fingerprint] value with the fingerprint for your own PGP key – Which is explained further down in this article.

p5.mime.save:/foo.mime
  multipart:mixed
    encrypt
      fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
    text:plain
      content:This is your MIME content!
    text:plain
      content:This is your OTHER MIME content!

The above would result in a file containing the following.

Content-Type: multipart/encrypted; boundary="=-s8kN2YhaHGekbhDQlp62PQ==";
	protocol="application/pgp-encrypted"

--=-s8kN2YhaHGekbhDQlp62PQ==
Content-Type: application/pgp-encrypted
Content-Disposition: attachment
Content-Transfer-Encoding: 7bit

Version: 1

--=-s8kN2YhaHGekbhDQlp62PQ==
Content-Type: application/octet-stream
Content-Disposition: attachment

-----BEGIN PGP MESSAGE-----
Version: 

hQIMAyVtX0VJiSVbAQ/+NfMak/aAqk88ybPXT4/Z0kmKy0t4rN6M3vl5duPnsoaq
ybAF/J6JOvzJkbgnelnTBuH18mvYCvRlUqb91trUZkGEiQ69i22LJPJlilIE/lWh
E238K2WcDe7bp6Jd3aQnwRUbhxF++Ej2r7SgF46JfaYga7GPQEtTLD5vv0bupU1r
YD96IhFkn8zciDRzzUFJpBfjJqfH3/AD/m4QXFv72u/PSqpCZ4JhxDe2OWn3UjOm
D8HYUsj38zLqDr5Yu186/bKWyGN02Ma7NBJfJuTU8bdYbC+vn7Xi4vOhT94Gm2zs
TS6X77vr4MIMVyxIpbJd4ZOpgR0Od5VIZK643w2k1QPb2ZjTxrCNFlveX6AsFAbG
S/L8muQ9cnyvalgrkZ/WjhoKgXc3zJTFGoo9ssJAjr4+wV8oFB10/03WOs2K05b5
GCzGFO/gz4oNEt2hS4kiE+j4J2lRTukQivie4P66zu6o6iA+LbftypWcHn2WtCvP
T1ChBKz1q+q9OlRngZsPU3dIPrfoUNX4EoAjx1LCel1FnUnHmlIMilrpL1Cr2S4I
ReUjHzgRL/qeQlmOh4MWIk9SeHYDMNifCHOkrH+ULyuht2ySe6LdIifZDQj0X27R
fu4sqlJ5XPJLzepp/2E0f/v9S6ew+/2k2I492yhpOdp1ebCnpDkxjb0ZRy92IiTS
uwHsFWLAca9X0GDNRWOZL7oqhcOiqv20FtXJFma38onfsESuu0yhgL9sSogEFekh
rbneKuZvD4deAOObRmWghd1uq2boVysmQuc7t+20D5k9ZZNXzrcVDJfbBJiHseM+
N2liJAL+jWlZenAFYGwehvIH9OKi9kdfmsyXVxxH4Oj80sI6nrECb4FwGtv+x89F
AyoiMR+Tdj9Ja0BW0LbNen+NTxm+gLDnAnyxGUYU9focis2s0WUFqo5e480=
=EzVG
-----END PGP MESSAGE-----

--=-s8kN2YhaHGekbhDQlp62PQ==--

This is actually how your “auth” file is persisted to disc, and the above will encrypt your MIME multipart, such that only you (having access to your server’s private PGP key) can decrypt it.

Notice, you’ll need to exchange the above [fingerprint] argument to [p5.mime.save] with your server’s actual fingerprint. You can find your server’s PGP fingerprint by for instance opening up your “auth.hl” file in for instance Hyper IDE, and see the first line in it – OR better, you can use the [p5.auth.pgp.get-fingerprint] Active Event to retrieve it dynamically. Which is probably the preferred way to retrieve it, since hardcoding the fingerprint into your code, would not make your code portable. Below is an example of dynamically retrieving your server’s PGP fingerprint to accomplish the same as above.

p5.auth.pgp.get-fingerprint
p5.mime.save:/foo.md
  multipart:mixed
    encrypt
      fingerprint:x:/@p5.auth.pgp.get-fingerprint?value
    text:plain
      content:This is your MIME content!
    text:plain
      content:This is your OTHER MIME content!

And in fact, if you do not supply a fingerprint, but still provide an [encrypt] argument, your server’s fingerprint will be assumed, allowing you to easily encrypt your MIME envelopes with the following code.

p5.mime.create
  multipart:mixed
    encrypt
    text:plain
      content:This is your MIME content!
    text:plain
      content:This is your OTHER MIME content!

Cryptographically signing your MIME entities

If you want to cryptographically sign your MIME entities, this is equally easy as encrypting them. This has a lot of advantages, allowing you to create a guarantee of that the MIME envelope has not been tampered with in any ways, and originates from the party having access to the private PGP key that was used to sign the envelope. This hence gives you a cryptographic guarantee of that nobody has in any ways “tampered” with the message somehow, from the time it was created by the private PGP key that was used to sign it, to the time you received it. Below is an example.

p5.mime.create
  text:plain
    sign
      fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
        password:ThisIsNotAGoodPassword!!
    content:This is your OTHER MIME content!

The above will produce something resembling the following.

p5.mime.create
  result:@"Content-Type: multipart/signed; boundary=""=-A4YJFmKDqqYVy1NO0smuKg=="";
	protocol=""application/pgp-signature""; micalg=pgp-sha256

--=-A4YJFmKDqqYVy1NO0smuKg==
Content-Type: text/plain

This is your OTHER MIME content!
--=-A4YJFmKDqqYVy1NO0smuKg==
Content-Type: application/pgp-signature; name=signature.pgp
Content-Disposition: attachment; filename=signature.pgp
Content-Transfer-Encoding: 7bit

-----BEGIN PGP MESSAGE-----
Version: 

owJ4nAEfAuD9iQIcBAEBCAAGBQJbJhWKAAoJECVtX0VJiSVbozQP/ikZNPnNhB3w
I5A9d+h5Qn+rVJToWfRczhbpl22VymYLeKsLCrLgmSlZxGa/B8PYRwKD6FkYF6aV
nQ7QkMacnwUN429MfwhRJYSMzwRBF4q/Vdd8qaT2WEvSlEmbHg4NeVNLa/IRAnII
KNcAcS7IenILM0IBRX6CKFzPicZL9AAiNwR2x+u45+Ztzs2Rt3Z/5pnXmosO+47D
5+iTfEZJEIrAwELTSMYA/Si+9hQPTICJ5Yc+gcGSzg5JjjKHEGLodzzSxLb1bhwR
8mdUw1gktUaQscZp3kTSGUI8ZYscEjPlsGjSEwZQ9rX16guvHTEjs2qgxd2eP/4t
MIF9W22C86Bf5ffxPwS+7ldJEnaw70Q1geg1hA6K9lfHb3ckaTDdl8RJPE4KcQSv
JaE5ypr9d1LupDjtAN32V9ZSKNGwSU8gz1amx14eoQthwKRVe1kCS6j3DWGWJCbS
B4N/eLG8unkuOiCPZRz2PHGtug1dHXh4p3W7XptEcSTtDeFP0JTWawMaucS8CWNN
+7sgWm7yFxu055vhynGz7J3gGirjeLl8rJctTuXnlU9XCs/eqi/V9H2AtATeUshx
jiX90WtWbH+IaYBI3rMHWTIS7JBSpLZvuO1Kugau+TRKNFTfa21CWeSKUfgHX9QC
NAgFEWI5ytAmMufkbVXVjUcYhPTx94QTevz/BA==
=Vz1E
-----END PGP MESSAGE-----

--=-A4YJFmKDqqYVy1NO0smuKg==--
"

The PGP signature above will be verified when the MIME envelope is parsed, and if its signature is not verified, the MIME envelope will not be accepted. If as much as a single byte inside of your “text/plain” parts above has been tampered with, the signature will not be valid, and Phosphorus Five will not accept the MIME envelope. And since the signature is created with your private PGP key, and can be verified with your public PGP key, this creates a guarantee of that only the entity with access to the private PGP key was able to construct the above MIME envelope. While allowing anyone with access to your public PGP key to verify its validity.

Notice the [password] parts above. Since Phosphorus Five stores all private PGP keys synchronously encrypted, in the same format that GnuPG stores your keys – This implies that you’ll need to supply a [password] argument, in addition to your [fingerprint], to be able to sign your envelope. Yet again you can use a more dynamic approach to fetch your server’s PGP [fingerprint] and [password] such as illustrated below.

p5.auth.pgp.get-fingerprint
p5.config.get:gpg-server-keypair-password
p5.mime.create
  text:plain
    sign
      fingerprint:x:/@p5.auth.pgp.get-fingerprint?value
        password:x:/@p5.config.get/0?value
    content:This is your OTHER MIME content!

…or completely omit both the [fingerprint] and [password] parts, at which point your server’s PGP fingerprint and its password will be assumed.

p5.mime.create
  text:plain
    sign
    content:This is your OTHER MIME content!

You can of course both encrypt and sign your envelopes, using different fingerprints too if you wish. This allows you to encrypt an envelope for some recipient’s PGP key, while cryptographically signing it with your own private PGP key. This creates a guarantee of that the envelope originated from you, and that it hasn’t been tampered with – While only allowing the rightful recipient to decrypt it and see its content. And if you somehow receive a MIME envelope that has been cryptographically signed, Phosphorus Five will automatically download the public PGP key used to sign the message from a public PGP key server, if it does not have it from before. The last detail allows you to receive a cryptographically signed MIME envelope, for then to immediately start encrypting another MIME envelope to return to the sender. Immediately having established a secure communication channel. Both for authentication and encrypting the content sent back and forth.

Parsing MIME envelopes

So far we have only created MIME envelopes. Let’s look at how to parse them. This is equally easy as creating them, and can be done by for instance using the [p5.mime.parse] Active Event. Below is an example.

p5.mime.create
  text:plain
    sign
    encrypt
    content:This is your OTHER MIME content!
p5.mime.parse:x:/@p5.mime.create/0?value
  decrypt
    password:ThisIsNotAGoodPassword!!

Yet again, you can omit the [password] above, at which point your server’s PGP password will be assumed. And if you’re in the highly “paranoid” spectrum, you are of course free to change your PGP key’s AES password, which must be done before you install Phosphorus Five, by editing your web.config file. The above invocation to [p5.mime.parse] will result in something resembling the following.

p5.mime.parse
  multipart:encrypted
    signature
      thomas@gaiasoul.com:bool:true
        fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
    text:plain
      content:This is your OTHER MIME content!

Notice how the value for the above [thomas@gaiasoul.com] node is boolean true. This implies that the cryptographic signature has been verified, and that the message has not been tampered with in any ways. If it has a value of “false”, you cannot trust the message! Completely omitting all passwords and fingerprint arguments from above, to rely upon the server’s main PGP key, could be done by constructing your code like the following.

p5.mime.create
  text:plain
    sign
    encrypt
    content:This is your OTHER MIME content!
p5.mime.parse:x:/@p5.mime.create/0?value

The above works due to that if the message is encrypted, and no [password] is supplied, your server’s PGP password will be assumed, and the MIME envelope will be decrypted using your server’s PGP password, when the PGP key needed to decrypt the envelope is released from GnuPG. You can of course encrypt, sign, and decrypt multipart envelopes, nested in as many layers as you wish for that matter. Below is an example of creating and parsing a more complex MIME envelope.

p5.mime.create
  multipart:mixed
    text:plain
      sign
      encrypt
      content:Some MIME text part, this was encrypted and signed!
    text:plain
      sign
      content:Another MIME text part, this was only signed!
    multipart:mixed
      application:x-hyperlambda
        sign
        content
          foo:bar
            Hello:World
            this-was:cryptographically signed!
      text:plain
        content:Jo dude! This was not signed, nor encrypted!
p5.mime.parse:x:/@p5.mime.create/0?value

The above code will create a complex MIME tree structure with a multipart mixed as the root entity, containing two text parts, and another nested multipart, where some of your entities are signed, some are encrypted, and some are both encrypted and signed. You are of course also free to encrypt and sign your different entities with different PGP keys as you see fit. Allowing you to “triple encrypt” an envelope, with three different PGP keys, implementing arguably the “onion protocol” for web services, or emails if you wish …

Notice how we are able to directly supply “application:x-hyperlambda” above, and inject Hyperlambda directly as a node structure. This is a convenience feature, allowing you to easily transfer Hyperlambda in your MIME envelopes, and automatically have it transformed into a lambda structure on the receiving end – Assuming the entity that is parsing your MIME envelope has this feature. After executing the above, your result will resemble the following.

p5.mime.create
  result:@"Content-Type: multipart/mixed; boundary=""=-1hQmuiWvF8ISxBVeLWnprg==""

--=-1hQmuiWvF8ISxBVeLWnprg==
Content-Type: multipart/encrypted; boundary=""=-SS7K3W6vwN1PO8Q4J5EpCg=="";
	protocol=""application/pgp-encrypted""

--=-SS7K3W6vwN1PO8Q4J5EpCg==
Content-Type: application/pgp-encrypted
Content-Disposition: attachment
Content-Transfer-Encoding: 7bit

Version: 1

--=-SS7K3W6vwN1PO8Q4J5EpCg==
Content-Type: application/octet-stream
Content-Disposition: attachment

-----BEGIN PGP MESSAGE-----
Version: 

hQIMAyVtX0VJiSVbARAAiyRdBIPagxCPjh+Ecnj+cogBVFvG0icGJzwX2gjfuEMP
WgOojNr66i0FiCR2fZcrWpxZ79c6Z0tYNuUq+Nr90cEYvx5pPBenfrLG8XfjTJqJ
0lQvkaSDzG0E/bc327Nue6BuYnJhfrLIVj6GZ0dj3ilzX0ly+W481i/wpPDEiM6Q
dlXeLpsyvRDg6gdC/ADbtGj85sA2v0m38vEkApn9Fapg8hKusDYj2c/Ek2OCxpyZ
NCE3xUuD27yvk7DzS7qVUeJEAujulhSlyKMNhsdtUPduBXo9Wv63IdpsfxWUvVOc
8ACO8ieMrYWHS3+paiX690MrFrayySexUwWqXRD/eLY/Cc0KJGNbw2xIhqqxdjxr
Z0Ht3morKl04IcWTosZsNhWa6bxjMfbERWafeIa20d71HHDmz//hSv9vI5xa+Cjy
/3ELrQ+ns7mrdH05qYHaUIvdPKgwvmSeSoSa0fQXn2BHFRNaA5qUsrQvP8HcsFob
vPvpemZ7f0mdrdZ20rFgirVE28DpWNjODzK6RUJYMV2zoVYhXkNK8vp0WEiHSOnz
VNSdk0pQeniOOC57m1rXSG/6TbopZh2yKsHS3v7q5mh1eK1Yxf8ZiOOe756WZsJI
7ySUzYfKDnjOHNPOSZdtyBNuetxCvVtmP0ph+ff0hYHed/edNwk0gq4al1cSofzS
whUB3QhdtUpxVT1CKPSC/KmyrREIVV0k6/99NBeDlw7fPjEzVDCG5JDcOBGmfZ9S
3Y1oWRMdaS7kC+bl1NBLEeMx29/cmzrfMNNrIQ22FVYPglrl6QPjt7vhnlr7ta5y
tSf4whrMI6jDhgP0wszgnYDCZm1ers6KsZ2VWvU/CsCDQUAZP4L3PdkxYPWZ2kji
7t2Lhsy74rt76robh5XR+fI1rPCHdKmOPR8DHs7w9lbeHDugJNRE6ZvXrIEY7SWx
Dki50f3KzJVRO0pdo8PCSAxzM5PGi15ZMsE7Hy6lykt82Fkq3dIHHXE9mwu++e5d
ElIkZvrnQxpvRCrQWwRpnUeVPgENbx+3/aA/q92NZ3u1CGJL3eIe1Sw1QqhHNhx2
TOudluBUb+Rm5S9aRHuvvlvmL3ItSVbl1FXnBID/I5IfORMq1Zq7BinfVn2+/Az1
VssVX1T6JZKR7B9LV7fhENsR0XD+1jtMt9MKtByyyAxDhMZxXBhz4uzmIBZNEJvb
Lu+uxTOAYXpEVYEuYWL4ZHVdeZvJeTTwVw4Vm6mIH+tiqX1JdO/C5jAv82/wmsl1
qHA5Kua0sLI3r9juOhNRKP59vfN6n8p74BNpwTDUsbPhGklfEuy7bhJrVZKPn7Wy
pFLONf2XKMdg8wneLVAmu8oNrcPzVr5x3ITexPcx9XbdH78UbCAZtirfW1I+pHq+
4T5ZzE0LK3MznmfLU/3tA3JDcDGAQI7SXqGOvHMeeD23kiW/jCoyhnhUQiNshIbj
FN2RfABO3lASHF9tqa5QZwLLffzch5lyKOe0wOOVqRzjAACpEkcw/70CLcmiiSLl
7gLTBiuFoPrvxt09VX2BGJoMoIAI8Y2O1iS2Xdv+7kcra5EjnFn54jeJzDJ2vCpg
vgK/hRP1SyjaPGWkuMdK2TG/q1DsbbtgoEwy1NzFsJ7WIU3n8FEueSrNhB9IUvk0
nRU4XjkpEw==
=p6eN
-----END PGP MESSAGE-----

--=-SS7K3W6vwN1PO8Q4J5EpCg==--

--=-1hQmuiWvF8ISxBVeLWnprg==
Content-Type: multipart/signed; boundary=""=-0sFZ7mtzSwXM4jw8kueeKA=="";
	protocol=""application/pgp-signature""; micalg=pgp-sha256

--=-0sFZ7mtzSwXM4jw8kueeKA==
Content-Type: text/plain

Another MIME text part, this was only signed!
--=-0sFZ7mtzSwXM4jw8kueeKA==
Content-Type: application/pgp-signature; name=signature.pgp
Content-Disposition: attachment; filename=signature.pgp
Content-Transfer-Encoding: 7bit

-----BEGIN PGP MESSAGE-----
Version: 

owJ4nAEfAuD9iQIcBAEBCAAGBQJbJh3iAAoJECVtX0VJiSVbIksP/A7gaFbTWVb5
sbQQqHy5MErh+ZQisB8pwHIonPdlttEK4Q+yE9rw4DVtWszO9XUhJO2xzvGX6Qqw
fkDU0M7ybKG0gMMEhwgfRc9dcSaB8MQyii5wWS9YNTXqNUmoSRS0cP6ka0h65wxh
ISQRnounQcXOIhZZywy3+YY4ZOVbv7uAmgLbBQmYTZa28wPySRlSF6U5p7h0nlJw
4Lf3+4FEtBTCjHPk6OXWpAv9cHWN7BatnoQJjFcGPks/DLy0X3UqJSrHKqOsBSa8
7Lqh/SrGBvOdkdP0Br5SNWKNGAeXrKNte3HgBNY68/IX3hAAPVd3ib2MY3oycyN0
ldzNmtVTU9ECgmz05+v35pU6unpePpKzewa2cO5koL2wnOOACOJoXisMRcXf1K/3
2/d0BP0rDGRJkc09NzLLIlBadU6iTCSo7ReQSZL9KcRCBNHkPrbLJbH3bYJBkdf+
A740RbRRY8CXswWArmAs6hg3b8ZkB8L+F2vTv3p1C311DONsugh9w1LHn9ozG+dC
E4A/zQk7zlyk0SFGm3vFfbdZf9BaL3qzMAzJzBagjO1mACHFGGYvfOcVWEcqIHMM
2U+5ACj3GjHAmGHVS3YiguF1YmLQEeImtLyW3lALrvez/bPkgQEKSXeWB6iLMT2j
MVZXtK9qsFIMQ7XHrMpTFHYewwFj/2wlqL0BXQ==
=IPqN
-----END PGP MESSAGE-----

--=-0sFZ7mtzSwXM4jw8kueeKA==--

--=-1hQmuiWvF8ISxBVeLWnprg==
Content-Type: multipart/mixed; boundary=""=-h2rd7/XUKjoEz8p8LHfVZQ==""

--=-h2rd7/XUKjoEz8p8LHfVZQ==
Content-Type: multipart/signed; boundary=""=-svINFQvFWbaDHisdxgmtFQ=="";
	protocol=""application/pgp-signature""; micalg=pgp-sha256

--=-svINFQvFWbaDHisdxgmtFQ==
Content-Type: application/x-hyperlambda

foo:bar
  Hello:World
  this-was:cryptographically signed!
--=-svINFQvFWbaDHisdxgmtFQ==
Content-Type: application/pgp-signature; name=signature.pgp
Content-Disposition: attachment; filename=signature.pgp
Content-Transfer-Encoding: 7bit

-----BEGIN PGP MESSAGE-----
Version: 

owJ4nAEfAuD9iQIcBAEBCAAGBQJbJh3iAAoJECVtX0VJiSVbBiEQAIWuIvQMkoa9
eMA6z0S0b5YPDtOcHK624fGh075tYz1AmXFHuND5h+2W+2ZMpoIt1Xd3+pbEaxWY
XQ/oCCb0lhkAFQGSKJzi9CNpblWECCt9E87QuSbBUGLJMmFpUUb6exWyB6uWDoMf
I3/cSTWrgbMwrnYBlsZWw3WxH1eUyID8zvPMpveIWgHoNV1REoH5/V6gNcGOEUMi
W1kE1mp4pjzAaN29S14MaqLSzM/Dz+fe/mq+tMytph1kahggs3rZSVqlvN6Io5/U
99Cg4vm38hEDbSGVjyoiNIal0VCOh/G0aHhbd/BrDR9NF7gDwuFPA0jvuxVTXssc
aPdGU4oUvMQ53eV8AFqIEyqfZVDgHNimZ8lbv/UNBqm9Et763UniZC2Xdx9iMUW7
msA3UHTYUYpr/N0uamw69jnzprf3tx00FuyV5Pn8TGkQ/rQiFgYF8QtZwi2LJYc5
wYb0bRSY5h97ynvXvJC/KbXc0e56KTDcRs6xL2/xpnHd7mmlQ8jXJhCY+TTBgIwF
uPQhafvzgAg7ZzWEeuevP7A5vEh0HZMHn0Aa8OYiMSbdVZI/d42jlfIFB8S5+DSG
+4YI4jyt4H1gN0g5RKcL2GAyOkftNySaQINb/047RoyeGvl9tpKXL7bxACZ75kXF
ud+23IkOaLNgTy0LTG2yM2pDhKHLFURVliEFCg==
=pIAf
-----END PGP MESSAGE-----

--=-svINFQvFWbaDHisdxgmtFQ==--

--=-h2rd7/XUKjoEz8p8LHfVZQ==
Content-Type: text/plain

Jo dude! This was not signed, nor encrypted!
--=-h2rd7/XUKjoEz8p8LHfVZQ==--

--=-1hQmuiWvF8ISxBVeLWnprg==--
"
p5.mime.parse
  multipart:mixed
    multipart:encrypted
      signature
        thomas@gaiasoul.com:bool:true
          fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
      text:plain
        content:Some MIME text part, this was encrypted and signed!
    multipart:signed
      signature
        thomas@gaiasoul.com:bool:true
          fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
      text:plain
        content:Another MIME text part, this was only signed!
      application:pgp-signature
        Content-Disposition:attachment; filename=signature.pgp
        Content-Transfer-Encoding:7bit
        content:blob:...long blob...
    multipart:mixed
      multipart:signed
        signature
          thomas@gaiasoul.com:bool:true
            fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
        application:x-hyperlambda
          content
            foo:bar
              Hello:World
              this-was:cryptographically signed!
        application:pgp-signature
          Content-Disposition:attachment; filename=signature.pgp
          Content-Transfer-Encoding:7bit
          content:blob:...long blob...
      text:plain
        content:Jo dude! This was not signed, nor encrypted!

One detail to notice in the above result, is how when you sign or encrypt a MIME entity, the entity is wrapped inside a “multipart:signed”, or “multipart:encrypted” wrapper entity. This is as expected, and necessary to correctly create your MIME envelop. To understand this process, and structure, feel free to run the following through Hypereval.

p5.mime.create
  multipart:mixed
    text:plain
      encrypt
      content:Some MIME text part, this was encrypted!
    text:plain
      sign
      content:Another MIME text part, this was only signed!
p5.mime.parse:x:/@p5.mime.create/0?value

… which of course results in the following …

p5.mime.create
  result:@"Content-Type: multipart/mixed; boundary=""=-DOjAG3V6uxgcYDTlvGj87Q==""

--=-DOjAG3V6uxgcYDTlvGj87Q==
Content-Type: multipart/encrypted; boundary=""=-vpiloBWqr+yJgOppg3UftA=="";
	protocol=""application/pgp-encrypted""

--=-vpiloBWqr+yJgOppg3UftA==
Content-Type: application/pgp-encrypted
Content-Disposition: attachment
Content-Transfer-Encoding: 7bit

Version: 1

--=-vpiloBWqr+yJgOppg3UftA==
Content-Type: application/octet-stream
Content-Disposition: attachment

-----BEGIN PGP MESSAGE-----
Version: 

hQIMAyVtX0VJiSVblah, blah, blah ...
=rNM+
-----END PGP MESSAGE-----

--=-vpiloBWqr+yJgOppg3UftA==--

--=-DOjAG3V6uxgcYDTlvGj87Q==
Content-Type: multipart/signed; boundary=""=-li3Lt5cIlPNcSHm3d0s1eQ=="";
	protocol=""application/pgp-signature""; micalg=pgp-sha256

--=-li3Lt5cIlPNcSHm3d0s1eQ==
Content-Type: text/plain

Another MIME text part, this was only signed!
--=-li3Lt5cIlPNcSHm3d0s1eQ==
Content-Type: application/pgp-signature; name=signature.pgp
Content-Disposition: attachment; filename=signature.pgp
Content-Transfer-Encoding: 7bit

-----BEGIN PGP MESSAGE-----
Version: 

owJ4nAEfAuD9iQblah, blah, blah ...
=ifqy
-----END PGP MESSAGE-----

--=-li3Lt5cIlPNcSHm3d0s1eQ==--

--=-DOjAG3V6uxgcYDTlvGj87Q==--
"
p5.mime.parse
  multipart:mixed
    multipart:encrypted
      text:plain
        content:Some MIME text part, this was encrypted!
    multipart:signed
      signature
        thomas@gaiasoul.com:bool:true
          fingerprint:E43BB8C3A3B9E8DE980051A3256D5F454989255B
      text:plain
        content:Another MIME text part, this was only signed!
      application:pgp-signature
        Content-Disposition:attachment; filename=signature.pgp
        Content-Transfer-Encoding:7bit
        content:blob:... some long blob ...

And since the signing key’s fingerprint is returned as a MIME envelope is being parsed, you can easily do a lookup into (for instance) a database of “trustees”, to see if the MIME envelope was signed by an endpoint you trust or not. This allows you to for instance transfer code over a web service, and execute that code at the web service endpoint, assuming the receiver trusts your PGP key’s fingerprint. However, that is the subject of another article.

MIME headers

Just like HTTP, MIME can also supply “headers”. These are pieces of “meta data” that somehow describes the envelope and entities. Basically, the way you’d supply a MIME header, is by adding it as a simple argument to your MIME entity. Below is an example.

p5.mime.create
  text:plain
    Howdy:World
    content:Foo bar content!
p5.mime.parse:x:/-/0?value

Which results in the following.

p5.mime.create
  result:@"Content-Type: text/plain
Howdy: World

Foo bar content!"
p5.mime.parse
  text:plain
    Howdy:World
    content:Foo bar content!

The idea with a MIME header, and how it is recognised as such by P5, is that it is expected to have at least one CAPITAL letter. Since all the standard MIME headers obeys by this rule, this allows you to add any MIME headers you want to – Including all the standard headers. If you’d like to supply a “Content-Transfer-Encoding” for instance, this can be accomplished with the following.

p5.mime.create
  text:plain
    Content-Transfer-Encoding:base64
    content:Foo bar content!

… resulting in the following …

p5.mime.create
  result:@"Content-Type: text/plain
Content-Transfer-Encoding: base64

Rm9vIGJhciBjb250ZW50IQ==
"

Since MimeKit and Phosphorus Five automatically handles all the default MIME headers, this allows you to use any standard MIME features you want to – In addition to providing any type of additional “meta data” to your MIME entities.

Parsing MIME envelopes directly from disc

The same way we could create a MIME envelope, and persist it to disc in one of our above examples – We can (of course) also parse a MIME entity directly from disc. For instance, in one of our above examples, we created a “foo.mime” file. To parse this file is as simple as follows.

p5.mime.load:/foo.mime

… which results in the following …

p5.mime.load
  text:plain
    content:This is your MIME content!

Of course, you can parametrise your [p5.mime.load] event the same way you can parametrise your [p5.mime.parse] events.

Attachments

The MIME standard has support for attachments. You probably knows this as “email attachments”. However, there is nothing preventing you from using it in any other types of scenarios you want to. However, before we look at file attachments, realise that instead of providing a [content] argument when creating your MIME envelopes, you can optionally instead supply a [filename] argument, pointing to a file on disc. Below is an example.

p5.mime.create
  text:plain
    filename:/startup.hl

Notice, instead of providing inline [content], we declared the content as a [filename] argument. You can of course create as many MIME entities you wish, each pointing to a different [filename].

The above code will create a MIME envelope with a “Content-Disposition” MIME header containing the content of your “startup.hl” file. Its result will resemble the following.

p5.mime.create
  result:@"Content-Type: text/plain
Content-Disposition: attachment; filename=startup.hl

/*
 * Initialises Phosphorus Five.
 *
 * This is being done by evaluating all ""startup.hl"" files, for all modules found
 * in the system.
 */

...blah, blah, blah - The rest of the file ...
"

In fact, unless you explicitly add a [Content-Disposition] argument to your above [p5.mime.create] MIME entity, Phosphorus Five will automatically add one resembling your file, allowing the receiving end automatically deduct that the MIME entity is an attachment. When you parse the MIME envelope you can choose to explicitly save attachments to a folder of your choosing. Below is an example.

p5.mime.create
  text:plain
    filename:/startup.hl
p5.mime.parse:x:/-/0?value
  attachment-folder:~/temp/

The above will not load any attachments into memory, but rather directly persist them to your user’s “temp” folder. This of course preserves memory, allowing you to transfer large files, and/or many files, without exhausting your server’s memory.

Notice, to avoid having filenames crash, and overwrite pre-existing files, the actual physical filename will be “randomised”. This is an automatic feature in Phosphorus Five, making the file name (by default) resemble for instance “597a148fd1984f61be9bddb3c96c4d76-startup.hl”. However, since the [p5.mime.parse] Active Event will return the filename as follows …

p5.mime.parse
  text:plain
    Content-Disposition:attachment; filename=startup.hl
    filename:startup.hl
      prefix:597a148fd1984f61be9bddb3c96c4d76-
      folder:/users/root/temp/

… you can easily deduct the actual physical filename, and its original name, as supplied when the MIME entity was created. To load the file persisted above, you can use for instance the following code.

p5.mime.create
  text:plain
    filename:/startup.hl
p5.mime.parse:x:/-/0?value
  attachment-folder:~/temp/
load-file:~/temp/{0}{1}
  :x:/@p5.mime.parse/0/*/filename/*/prefix?value
  :x:/@p5.mime.parse/0/*/filename?value

If you don’t want the Phosphorus Five’s MIME parser to “randomise” your filenames, you can add [attachments-use-prefix] and set its value to boolean “false”. Below is an example.

p5.mime.create
  text:plain
    filename:/startup.hl
p5.mime.parse:x:/-/0?value
  attachment-folder:~/temp/
  attachments-use-prefix:false

… which will result in the following …

p5.mime.create
  result:@"Content-Type: text/plain
Content-Disposition: attachment; filename=startup.hl

/*
 * Initialises Phosphorus Five.
 *
 * blah, blah, blah - Rest of file ...
 */
"
p5.mime.parse
  text:plain
    Content-Disposition:attachment; filename=startup.hl
    filename:startup.hl
      folder:/users/root/temp/

AND a file in your user’s “temp” folder named *only* “startup.hl”.

About PGP

Open PGP is a cryptography standard, allowing you to (among other things) encrypt data. It is based upon “public key cryptography” or “RSA”. You can watch a 3 minutes long video about it below.

Basically, its idea is that you can encrypt something with a public key. For then to only have the owner of the private key being able to decrypt it.

Its other part is “cryptographically signing” data. When you cryptographically sign something, you use your private key to sign it, and then anybody having access to your public key, can easily verify that the data originates from the guy having the private key – AND that it has not been tampered with since it was created.

When data is encrypted, it is also compressed (think “zipped”). This process significantly reduces the size of your data, in addition to that it becomes impossible for an adversary to see what data is being transferred.

These features combined allows you to use an inheritingly insecure communication channel (HTTP or the “World Wide Web”) to send cryptographically secured data, having a guarantee of that the data originated from who you thought it originated from, has not been read by anybody else but its recipient, and has not been tampered with by anyone since the sender created the data – In addition to that it significantly reduces the size of the data transferred, and such reduces bandwidth consumption when sending your data.

Since PGP is *integral* to Phosphorus Five, and also *blistering fast*, this allows you to do some pretty amazingly cool things with it. Phosphorus Five as of version 8.4, also have no way to export or see the private PGP key, which is by design, and hence your server has now all of a sudden the closest you can come to a 100% perfectly secured communication channel to communicate with other servers, and or encrypt data. Notice, there are no guarantees when it comes to security, but assuming there are no security holes in Phosphorus Five, or the software it relies upon, this literally makes it impossible for an adversary, including heavy duty guys such as the CIA, NSA and FSB to actually see the content transferred between your server, and whomever you choose to communicate with.

Also notice that if you want to create a backup of your server’s private and public PGP key, you can do so by finding your “.gnupg” folder beneath your Apache’s HTML folder, where you can find your PGP key inside of it. You can do such a thing using e.g. SSH. However, to minimise the risk and consequences of any (God forbids) holes in your apps, and/or Phosphorus Five – I have consciously *explicitly removed the ability to export your private PGP keys* in the 8.4 release.

With that in mind, let’s look at some use cases …

Cryptographically secured backups

Creating a really secure backup is difficult. First of all, how do you avoid allowing an adversary to see the content of your backup as you download it, or store it on some medium? Secondly, how do you know nobody have tampered with your backups, and injected some malicious piece of code or data into it, that could compromise your server as you’re restoring your backup? Well, PGP to the rescue.

p5.mime.save:~/temp/backup.mime
  application:x-hyperlambda
    encrypt
    sign
    filename:/startup.hl
micro.download.file:~/temp/backup.mime

The above code will create a backup of your “startup.hl” file, encrypt it, cryptographically sign it, and download it to your client. Meaning even if an adversary can see what is being transferred over the wire, or somehow have access to your backup – He’ll still have no idea what it contains, and the resulting backup file will also be significantly compressed. As you restore your backup, you can check its cryptographic signature, and verify that nobody have tampered with your backup. In fact, since the file is both cryptographically signed, and encrypted, this literally allows you to store your backups in a public cloud somewhere, where anyone can access it – WITHOUT anybody being able to *read* it (or tamper with it). Just remember to verify the signature as you try to restore your backup. I’ll probably at some point create convenience events wrapping this in a future release of Phosphorus Five for the record.

Cryptographically secured web services

Although this is a fairly advanced concept, I’ll go through in another article later, I still want to talk a little bit about it. The idea however, is that if you couple PGP cryptography with lambda web services, which I have written about earlier here. You can all of a sudden, highly securely, allow for execution of Hyperlambda supplied by a client to your server, and such allow only trusted clients to execute Hyperlambda in your web service endpoint. The idea is that you have some sort of list of trusted clients, which are really nothing but fingerprints for PGP keys. And only if the MIME envelope containing the Hyperlambda has been cryptographically signed by one of the clients you happen to trust, you actually go ahead and execute the code transferred.

In fact, this is such a useful scenario, I will create automatic wrappers around it, probably for the 8.4 release of Phosphorus Five.

Securely transferring multiple files

Since MIME allows you to include multiple files in one envelope, and if encrypted, also significantly compress your files – This allows you to transfer hundreds, and actually thousands of files in one simple invocation from one client to some server. The files you transfer can of course be a mixture of text files, binary files, etc – As you see fit …

I will create examples of how to do this in a later article …

Securely storing data on your server

Sometimes a piece of information is so volatile in nature, and contains extremely sensitive content, to such an extent that you need to encrypt it, and/or cryptographically sign it too. In fact, Phosphorus Five contains a very good example of such data; Its “auth.hl” file. This file contains “user settings”, in addition to passwords (in hashed/Blowfish/bcrypt format though), usernames, and other pieces of extremely sensitive information. An adversary having access to this file, can do a lot of damage, since the file might potentially contain things such as your user’s POP3 and SMTP usernames and passwords for instance. PGP to the rescue again!

If you open this file in for instance Hyper IDE, you’ll see that the file is in fact encrypted. This prevents an adversary having access to the physical file to see its content, securing your users’ data, even though a breach of your server should somehow occur.

You are of course free to encrypt any files you create locally in your Phosphorus Five installation as you see fit. With any PGP key you want, allowing your users to for instance create their own private PGP keys, never storing the GnuPG password for these keys, asking them to supply the password when decrypting the files – Eliminating the server’s “root” account from being able to read the files’ content.

AJAX upload forms

If you take a look at the [micro.widgets.upload-button], you’ll see that internally it is actually using the MIME Active Events from Phosphorus Five. This is because as I create the Ajax request on the client with JavaScript, I transfer it as a MIME message to the server, for then to parse it on the server using the MIME events from Phosphorus Five. This allows me to easily use any “advanced browser” features, while using the blistering fast MIME features of Phosphorus Five and Hyperlambda to handle the requests on the server. In addition, due to how MimeKit is being consumed internally in Phosphorus Five, it allows me to upload files in the GIGABYTE size, without exhausting the server’s memory.

MIME is more that just email

I hope I now have proven that MIME is definitely interesting for more than just emails, and in fact highly useful for a lot of different scenarios. Ranging from browser to client communication, backups, and securely PGP encrypted web services …

MIME is truly quite Magical in fact … 😉

Advertisements

Pay us $$$, and we’ll secure your data!

This is your data in Google’s servers!!

It doesn’t take a rocket scientist to understand that when a company’s business model, it to steal your privacy, and sell it to the highest bidder – This might not necessarily be in your best interest!

The above paragraph, effectively summed up the “business model” of approximately 98% of every single Silicon Valley company, including Google and Facebook. Believing that these companies can secure your emails, or data in general for that matter, is probably pathologically insanity defined!

We on the other hand, have a really simple to understand business model – We simply charge you! And our product is privacy and data security! Basically, give us dollars, and we’ll give you clothes! Did you understand that, or do I need to explain it further for you …? 😉

Watch the viddi below, and see our value proposition for yourself …

Even Grandma understands this shit!

Encrypting your corporate emails in 30 minutes – Seriously!

We have just created a new release of Phosphorus Five, and its associated modules today. The most important part, is significantly easing user management, installation, and setup. Basically, you can now install it on a Linux server in 30 minutes (no exaggeration), and have your first email inbox up running 30 minutes after you’ve been given root access to your Linux server.

In the release text of Phosphorus Five, there’s a detailed description of how to get things up running on an Ubuntu Server in no more than three terminal commands, which you can simply copy and paste into your terminal, and you’ll be up running in no time.

One of the things I am particularly proud about with both Phosphorus Five and Sephia Five, is how easy it is to use. Often Linux software, especially when involving complex ideas, such as PGP cryptography, seems to be very difficult to use. Phosphorus Five have reduced the complexity, down to literally a couple of buttons, less than a handful of choices, and completely automated the rest of the process. Below is how it looks like when you compose a new email.

A really cool idea, I personally think, is that the autosuggest feature, does not necessarily display its suggestions in alphabetic order, but rather according to who sent you an email the most recently, matching your search criteria of course.

This means that it will highly likely show the person you want to send am email to as its first suggestion, simply since statistically, it is more likely that you want to send an email to a person who recently sent you an email. Most of the time, you only have to click it in fact, and then choose one of the five first matches. 90% of the rest of the times, typing in a single character will give you the email address of the person you want to send an email to. Hence, choosing a recipe will save you several keystrokes, significantly making things easier on small devices, with clumpy keyboards, etc.

Below is a screenshot of the process of creating new users.

Phosphorus Five is highly modular in design. It is truly a modular web operating system, from the grounds and up. This means that installing new applications into it, is as simple as clicking a button. In fact, the user module, which is called “Peeples”, is nothing but an additional optional “module”. This makes it easy to populate your server, with the exact apps you want to populate it with – Alternatively, easily create your own new apps, that seamlessly integrate with your existing apps.

Phosphorus Five is probably the first truly modular web operating system in the world.

Out of the box, you’re given 5 free user tickets. You’ll need one such “ticket” to create one new user. This means that you can setup 5 email inboxes, for free, without paying as much as a cent.

After you’ve spent your tickets, you can easily purchase new tickets, which will cost you €10 for a “Home installation” and €50 for a “Professional installation” – The latter includes professional grade support. There are no other fees than this, and everything is Open Source and Free Software (free as in freedom) – Below is a screenshot of just how simple it is to purchase additional user tickets.

If you click the above button, you’ll instantly receive your additional user tickets, and can setup as many user as you wish.

Responsive rendering

No web application platform with respect for itself, could possibly exist, unless it had some pretty kick-ass responsive rendering at its core today. Phosphorus Five and Sephia Five is no exception to this rule. Both systems renders perfectly on every imaginable device, and will responsively show content, according to your device’s screen resolution.

In addition, it uses only a fraction of the bandwidth that e.g. GMail uses – In fact, GMail will consume more than 25 times as much bandwidth. This makes Sephia Five and Phosphorus Five a perfect choice for those situations where you’re on a really, really slow internet connection. In fact, I am running my own personal email server out of my own home, on an old laptop, which I have converted into a Linux web server. And I have a standard home internet connection. Still it works perfectly for me. If you don’t believe me, check it out for yourself.

Of course, you won’t gain access to Sephia Five on my server, unless I give you a user though. But you can load the desktop, and check out my “welcome app”. Below is a screenshot of how your inbox might look like.

Notice the smileys in the grid above. A happy face means that your email has been sent cryptographically secured, while a sad face means insecure. Below is an example of reading an email.

One thing we’re particularly proud of, is that you can read multiple emails at the same time. Even on your telephone, since each email will simply show up beneath the previously read email. This allows you to cross reference content from multiple emails, possibly as you reply to some completely unrelated email, significantly empowering you in your daily “information battle”.

Use Markdown while composing emails

The composition of emails have been arguably destroyed by some big corporations (coff, coff, GMail, coff Outlook) – However, with Markdown, you can add simple formatting, without learning any complex rich text editors, or WYSIWYG editors, that always for some reasons seems obsessed with messing up your design.

Markdown is the intuitive way of adding formatting, which you’d probably do anyways, if resorting to a default text editor. The following syntax will **make your words or phrases bold for instance**. The following will make your words or phrases *italics*. Creating a numbered or bulleted list, you can probably guess how to do yourself, without me even telling you how!

Having your privacy

Sephia Five will seriously give you privacy. I literally mean that BTW. Not only can you send and receive encrypted emails, automatically, without even thinking about it – You can also expect to (seriously) never again receive a “slot machine” marketing email. This might seem to be a promise impossible to deliver upon, until you realise that Sephia Five will never show you another HTML email. I literally mean **NEVER** for the record!

This will create less cognitive noise for your brain, allowing you to stay within the comfort zone of your privacy, and keep your flow. In addition, the system can be configured to only allow your employees to check their emails at specific times of the day. Which of course, seriously reduces noise, and increases your employees productivity. When we ask you if you “Got Privacy?” – We really mean it!

Curious, check out my installation script, and of course, everything is Open Source 🙂

Literally, 30 minutes after starting, you’ll be sending your first email!

Got Privacy? Get Sephia Five!

ProtonMail and Sephia Five, a comparison

ProtonMail was the first main stream available cryptographically secured Open Source webmail system, that became popular amongst the common population, and was practical in usage for the masses. Andy Yen, one of its founders, even held a TED speech about it in 2015. Since I predict that a lot of potential users of Sephia Five will argue that “ProtonMail already exists, what’s the point with Sephia Five” – I thought I’d create a comparison between the two, to illustrate why I think Sephia Five definitely has the right to live.

First of all, I must say that I am fundamentally in agreement with Andy Yen, and I too believe that privacy is the number one issue in the 21st Century. I sincerely hope that ProtonMail succeeds, and helps us reinstate privacy among the general population of the Earth. Me and Andy’s visions are almost perfectly aligned in such a regard. I admire Andy and his colleagues for what they have done, and I wish them all the best!

When that is said, I thought I’d illustrate the difference, such that people can weigh the systems neutrally up against each other, and help make an informed decision. Below I have created a comparison between the two, on a point to point basis, illustrating the value proposition of Sephia Five, compared to that of ProtonMail.

Server side versus client side cryptography

Andy Yen argues that cryptography shouldn’t occur on the server, but rather on the client. This is based upon the assumption that the server is not owned by the end user, and/or entity that needs cryptographically secured email systems. In a “Google and GMail world”, he is right. However, web servers are becoming cheaper every day, and in fact, you could easily convert a 10 year old laptop, into becoming a personal web server, and have it run blistering fast today. And with cheaper and faster internet connections being delivered by our ISPs every day, setting up a “home server”, over a plain home internet connection, would only require a fixed IP address, which most ISPs would be willing to give you for less than $5 today. Hence, the argument is (almost) mute.

This would allow you to create a private web server, which you could put in your home, expose to the web, and use to access your email using any device, from anywhere in the world. This means that your private PGP keys would be much safer, since you wouldn’t have to put them on every device you use to read your email. This would increase the availability, without increasing the attack surface. Arguably, this is more difficult than to simply register at ProtonMail’s website, and start using it – However, that will soon also be a mute point, since creating a secured Linux web server, becomes increasingly easier for every day that passes, thx to among others Ubuntu.

Besides, JavaScript is notoriously infamous for security holes, and hence the probability of that a private PGP key could be compromised when stored on the client, is much larger than if you had your private PGP key on the server, never allowing access to it from the client.

With Sephia Five your private PGP key is probably orders of magnitudes more safe, than with ProtonMail – Sorry Andy …

Searching emails would also be more difficult, since the server won’t know the contents of the emails, and if you wanted to perform a search of every email you have in your inbox, you’d have to download every email to the client, decrypt it, and then perform a search. Needless to say, but this would literally explode your bandwidth consumption. On a server based key solution, you could simply decrypt the email once when it is received, store it in your database, which is secured on your server, and run a simple SQL when you want to search through your existing emails. I must admit that I don’t know how ProtonMail have solved this, but the search problem, is definitely a hard one for them I would assume.

Hence, the usability of a webmail system based upon client based private PGP keys, would highly likely significantly decrease, if you’re only allowing for decryption on the client side.

In addition, I would assume that a server side C# written PGP decryption library, would probably be able to encrypt and decrypt an email, several orders of magnitudes faster. Not to mention, it wouldn’t have to download any attachments in these encrypted emails to the clients, before the user explicitly requested them. Please feel free to correct me if I am wrong here though …

Business model

Sorry, but I cannot see ProtonMail’s business model. Either they have none, or I am simply too dumb to understand it. Sephia Five has what I feel is a very strong business model, which is based upon the needs of corporations for securing their email. This allows me to have corporations “pay for the fun”, while letting the people in general enjoy the benefits. Simply put, because our business model is to deliver additional addon services and products, which only would make sense for corporations and professional consumers, and charge for these. While allowing the general public reap the benefits by being allowed to use the core of Sephia Five for free.

This gives us the best of two worlds, where we would (hopefully) be able to create a community of devoted individuals, help us maintain and develop the system – While at the same time, allowing companies to reap the benefits, creating a symbiosis between the corporate world, and the home world. While ProtonMail would (probably) not be of interest to corporations, since paradoxically, these corporations would highly unlikely allow a cryptographically secured email system to be used in their organisations, which would not permit the management to have access to the emails of their employees.

The last point is crucial, since with ProtonMail, the decryption would occur on the client (correct me if I am wrong) – Which would not permit the employer to have access to emails sent by their employers. After all, when you use your corporate email address to send out emails, you are using the property of your employer – And the data you send in these emails, are ipso facto the property of your employer. In such a regard, ProtonMail would probably be useless for most companies, I would assume …

Arguably, the lack of business model, would I believe, makes ProtonMail into a fad, unless they’re able to pull a “WikiPedia” model out of their sleeves somehow …

Installation

This is probably the point where Sephia Five would come out as loosing. It is obviously easier to create a username and password over at ProtonMail’s website, create a private PGP key pair in JavaScript, and start sending and receiving emails – Than it is to setup your own web server, and install Sephia Five.

However, this is also Sephia Five’s main selling point, since we actually charge for helping companies and corporations setup their own servers. Hence, what seems to be the losing point for Sephia, is actually what ensures we have a business model, and are able to sustain further development, by making money doing what we love! Which is the one thing we have in common with the guys behind ProtonMail.

Privacy matter!!

Addendum; For the record, ProtonMail’s main selling point seems to be that they’re located in Switzerland. With Sephia Five you could install your server, and host your data where ever you wish. Including Switzerland, Bangladesh or the Bahamas for that matter …

Sorry Andy, we won that last one … 😉

Yet again, I wish ProtonMail good luck, and would like to finish up with a personal encouragement to Andy and his guys over at ProtonMail.

Give em’ hell bro!!

Sephia Five – Military grade Cryptography

Sephia Five, keeping your most precious belongings where they belong

Sephia Five makes PGP cryptography ridiculously easy to use. There are almost no more complex things for you left to do, and you have your emails almost automagically secured for you. Sephia Five makes your email communication cryptographically secure, without you having to put in any effort for it to happen.

Sephia Five is paranoid software, to such an extent, that it will even encrypt your subject, to not give adversaries anything to start with, when trying to figure out what your emails contains. In fact, an adversary will only see some random subject, fetched from for instance the New York Times, Wall Street Journal, or some other customised babelizing service. This feature encrypts and hides your original subject, and also makes your emails being perceived as innocent discussions about your local news. Which babelizing service you wish to use, can easily be configure in your settings.

Virus and malware protection

In addition to super secure cryptography, Sephia Five makes it much harder for you to have your computer infected by viruses and other malware. Sephia Five will warn you if you try to download an attachment that is not considered 100% safe. This makes it harder for you to become infected by viruses, since you’ll consciously have to make a decision yourself, to download a virus or some other malware.

Almost all intrusions into organisations today happens through ‘phishing’. Sephia makes this almost impossible, since it clearly shows you who you can trust, and which attachments you can safely download, without being hacked.

Never send emails to the wrong recipient again

Sephia Five will warn you, if you try to send an email to an email address that is not on your list of contacts. Most security breaches are due to human nature. If you send an email containing confidential information to the wrong email address, this might have devastating consequences for you and your organisation.

The difference between a trusted colleague, or some random person, might be as little as a single dot. A lot of scandals have occurred due to the one sending the email wrote johndooe@gmail.com instead of johndoe@gmail.com. If you try to send an email to a person that is not in your list of contacts, Sephia Five will warn you, and stop the email from being sent, until you confirm that you still want to send it. If you still choose to send the email, this recipient will be added to your list of contacts, avoiding future warnings for the same email address.

The most aggressive spam filter in the industry

Sephia Five contains what is probably the most aggressive spam filter in our industry. By default, spam filtering is turned off, but if you wish, you can setup Sephia such that it labels all emails that originates from people that you’ve never sent an email to first as spam. We refer to this is the ‘Hollywood spam filter’. You can also have a requirement that emails are cryptographically signed, and/or encrypted, before they’re accepted into your inbox.

Hollywood spam filter implies; “Don’t call us, we’ll call you”

And of course, you still have the ability to manually check emails that are caught in your spam filter, and explicitly mark them as safe. If you do, then all future emails from that sender will avoid your spam folder. You can also do the opposite, and mark an email explicitly as spam, at which point all future emails from that contact will be treated as spam.

This gives you 100% perfect control over your privacy, through a very simple ruleset, that puts you in control, while still being as automated as possibly, not adding anything to your daily routine in any ways, that could be defined as additional workload. Often email software vendors tries to create spam filters based upon artificial intelligence, which ends up creating algorithms you cannot understand, and hence you tend to loose a lot of email that you want, and receive a lot of email that you do not want. This will simply never occur with Sephia Five, since the spam filter in Sephia is created around a simple ruleset, easily understood, and predictable for you as you use Sephia Five. Even though the spam filter in Sephia is ridiculously easy to understand, it is still extremely strong, making it easy for you to never again receive spam, or ever again drop an email you actually wanted to have.

Privacy is more than just cryptography

Don’t get me wrong, cryptography is super important, for anyone taking their business seriously. But Sephia Five also contains privacy features that allows you to literally have your privacy. Sephia Five can be configured such that it only allows its users to check their emails at specific times during the day. This allows you to stay focused on your tasks, during most parts of the day, and create specific times during the day, when you want to read your email. This can be configured on a per user/role basis.

If you are experiencing problems with your employees spending too much time reading and answering emails, then we have the fix for that.

Sephia Five is not ‘slot machine’ software

A lot of software vendors are unfortunately creating what we like to refer to as ‘slot machine software’. This means that the software is full of bells and whistles, that interrupts you, or somehow steals your focus away from your tasks.

Sephia Five contains almost no message bubbles, few colours, no logos, and nothing else that distracts you from doing what you want to do – Which is to get to your information, as fast and cleanly as possible. Sephia Five allows you to read and send emails, within the comfort zone of your privacy, period. This feature if Sephia Five allows you to stay much more focused, avoiding interruptions, as you try to finish your tasks. Sephia Five does not pollute your mind with endless distractions and fancy colours. Sephia Five almost completely eliminates all ‘cognitive noise’.

Sephia Five puts the Zen into software

Usability

Sephia Five’s feature list, also contains features that are not about security. For instance, you can compose emails using Markdown, which allows you to add formatting to your emails, using the familiar Markdown syntax. This allows you to create rich text emails, without using any complex editors, simply by adding your formatting commands using Markdown.

Markdown is the intuitive way to create formatted text, to emphasise and group related information, using nothing but the text itself. To emphasise something, simply add an asterix surrounding the word you want to have emphasised. To further emphasise something, add two asterix around the text you want to have emphasised. The list goes on, but really, you don’t have to learn Markdown to take advantage of it – Simply because you already intuitively know Markdown, since Markdown is the way your brain would automatically add formatting to your text, as long as you take a little bit of care when you write.

Another feature we’re particularly proud of, is that you can have multiple emails open at the same time. This allows you to read and reference parts from multiple emails, while composing or replying to some other email(s). Try to open up all the welcome emails in your inbox, and see how this works in practice.

With Sephia Five, you can also create ‘conversations’, which keeps track of who said what, as you and your friends replies to each other emails’. This allows you to much more easily follow the flow of your communication, and see it in context. This too almost happens automagically as you reply to other people’s emails, at least as long as all recipients are using Sephia Five.

If you are tired of endless marketing emails, with tons of colours and images in your inbox – Rest assured of that Sephia Five will never show you another HTML email for as long as you live. You can still fully take advantage of Markdown if you do, since as previously said, this is the way your brain would logically interpret the context and important parts of your emails.

Sephia Five is also carefully constructed such that it does not become noisy for your brain and eyes. This is important for your brain to be able to pick up the most important parts of your communication. Imagine trying to hold a conversation at a rock concert. Obviously, it is more difficult to understand what’s being said. Sephia Five is carefully constructed in a visual and psychologically silent way, such that it becomes easier for your brain to focus on what you should focus on; Your data. Sephia Five has few buttons, and does a lot of intelligent automatic background work for you. This means that you get a more silent psychological and visual environment to communicate with your colleagues and friends, with fewer misunderstandings.

Sephia Five is environmentally friendly software, created to be friends with your mind, and not fight it for attention, for some randomly placed ad, logo, or marketing gibberish. This clean way of communicating, cannot be emphasised enough, since it allows your brain to more easily digest the important parts of your communication. The number of buttons and choices have been carefully reduced to a minimum – Such that only what is relevant for you will be displayed at any time. Colours are by default kept to a minimum, and there are no ads stealing your attention. Sephia Five is built to be friends with your mind, and never distract you, from what you want to do.

Sephia Five works on every device you already have, allowing you to access your emails on your tablet, computer or phone

Possibly the best part of Sephia Five, is that you don’t need to change your existing email address. You can setup Sephia Five to use your existing email address, including GMail if you wish – And the transition to becoming 100% secure online, becomes 100% transparently implemented, without you feeling anything, besides that warm and cozy feeling of that your communication can now be 100% perfectly trusted, and that you have reclaimed your privacy.

Performance

Sephia Five is ridiculously small in bandwidth footprint. GMail uses more than 4MB of bandwidth consumption when opened without cache turned on, and 1.5MB if cache is turned on. Sephia Five will use 0.25 MB at the max with cache turned off, and roughly 0.05 MB with cache turned on. This means that Sephia Five is perfectly fine working over very slow internet connections.

This also means that Sephia Five can open your emails faster, and you can start composing your emails faster, and in general terms wait less, than that which you’ll have to do when using most of the alternatives out there. Sephia Five responds faster than your brain and fingers. This is something you will learn to appreciate as you start getting used to it.

Time is money, if that is true, Sephia Five gives you money, since it gives you more time

Sephia is Open Source and Free Software

Sephia Five is also Open Source and Free Software. This means that you or anybody with knowledge about programming, can scrutinise its code, to make sure that there are no backdoors in the system. This is our guarantee to you about that we take your privacy important.

This also allows you to modify it and customise it as you see fit, and it makes you less dependent upon having to trust others to maintain your installation of Sephia Five. Sephia Five returns your Freedom to you, and empowers you in every way.

Reclaim your Privacy, reclaim your Time, reclaim your Freedom – Download Sephia Five

How to become a customer of us

Some of our software products contains military grade cryptography. Data can be many things. It can be corporate secrets, which you are legally allowed to keep as secrets. It can however also be recipes for creating nuclear weapons, or plan out terrorist actions. Therefor, in order for us to not violate EU law, we are obligated to have our customers write us an email, have it cryptographically signed, by a PGP key, that is verified by two witnesses. Exactly how to do this, we will tell you when it is time for us to finalise our agreement. Notice, this does not include customers that are using Phosphorus Five, System42, Micro or the Open Source version of Sephia Five. The reasons are that we are not distributing this cryptography software to anyone directly ourselves. However, some of our other products, include military grade cryptography integrated into the core, and hence we must ask our customers to give us a written legally binding confession of good faith. This email must contain the following text.

I hereby solemnly swear, that I will not use any products I have purchased by T.H. Rose Home Cloud, Ltd to export nuclear weapons, other weapons of mass destruction, plan out terrorist actions, or in any other ways commit criminal actions, that could in any ways make T.H. Rose Home Cloud, Ltd liable for my actions. I also understand that if T.H. Rose Home Cloud, Ltd was to ever find out that I have violated European Law in such a regard, T.H. Rose Home Cloud, Ltd will immediately break all further cooperation with me, and no longer be able to give me support, help, updates, or in any other ways continue the partnership with me and/or my company/organisation. If such a thing were to happen, I understand that T.H. Rose Home Cloud, Ltd will break off all further cooperation, without giving me any refunds for any monetary transactions that have already at that point taken place. This includes also exporting and/or distributing products given to me by T.H. Rose Home Cloud, Ltd to any country currently on the United Nations embargo list, such as North Korea, Al Qaeda, Iran, etc.

When you have sent us an email containing the above text, cryptographically signed, by a PGP key that has been verified by at least two witnesses within your organisation, we are happy to welcome you into our little family.

Kind Regards,

Thomas Hansen

The Universe is constructed to keep secrets

The above words aren’t mine, they’re actually Edward Snowden’s. For some reasons, the Universe seems to be created in such a way, that it is geared towards secrecy. Meaning, people who want to keep secrets, and communicate securely, without any adversaries discovering what they’re communicating about – Seems to have this capacity woven into the very fabric of time and space.

When one cryptography algorithm stops working for some reasons, another seems to simply take its place, until we reach the point where everything seems to become “babble” for most people. However, what’s babble for one person, is legitimate information for another. What I mean by that, is that unless people can communicate in privacy, the public space will be littered with “code words”, through the laws of emotional cryptography, making no sense for anyone, except the recipients and its sender.

This creates a dangerous situation, where if our governments attempts to break all possible secure communication forms, all information breaks down, and turns into “code speak”. Resulting in that all the surface information in the public available space, turns into rubbish. Don’t believe me? Ask Donald Trump what covfefe means … 😉

Two people, who are are closely emotionally attached, could if they wanted to, plan out whatever crime they wanted to plan out, publicly on their local police office’s Facebook profile – And none would understand what they were talking about, before it was too late to stop it from happening.

Hence, to increase the quality of our information, it is sometimes better to allow for secrecy to some extent, and allow people to communicate securely. Because communicate in secrecy they will anyways, and none will understand what they’re communicating about, regardless of how much “surveillance” we put in place.

So by increasing the amount of cryptography on the public internet, we increase the quality and sincereness of people’s communication, and reduce the amount of apparent garbage on the surface web, allowing the surface web to be beautifully open, with information intended to enter the public space – Instead of what it is today.

A garbage can of emotionally encrypted information, apparently junk for most people, but actually meaningful for some very few.

These were the wisdoms the story of Odin were attempting to tell us. By sacrificing one of his eyes, consciously closing his eyes on some of the things he could have seen if he wanted – He lost nothing! But everybody else gained a lot! Hence, commoditising cryptography, paradoxically increases the openness and availability of publicly available information.

Cryptography is the art of improving the quality of the surface web, by consciously allowing people to communicate secrets in the dark, not polluting the surface web, with the garbage from the bottomless pits of the dark web.

Therefor I have no remorse or guilt for completely commoditising cryptography. Simply put, because people would have been able to communicate in secrecy regardless of what countermeasures our governments put in place. But by commoditising cryptography, allowing consciously people to communicate in the dark – We increase the quality of the content on the surface web!

BTW Donald Trump. Yup, totally agree! LA8PV, brown cheese! ASAP! Here’s another message for you dude!

Emotional cryptography

If I started out a paper about a scientific theory with the following sentence; “Empirical proof of that Unicorns exists” – Most scientists on the planet would produce cognitive dissonance, and dismiss the theory in its entirety immediately, without even reading the rest of it. Cryptography is the art of conveying secrets in plain sight. Facts are, this art form is much older than you can possibly imagine!

Most people presented with a PGP message will believe it is rubbish. Only the ones with the necessary “context” to understand it, will be able to take it seriously. “Context” here being of course in relationship to PGP, the private PGP key necessary to decrypt the message.

Such “cryptography keys” can be created in many ways. They can be culturally dependent and interconnected, such that only the ones who were raised in a specific culture are able to understand them. They can be based upon a belief system, such that only the ones able to hold a specific belief in their heads, are capable of reading them. They can be culturally aware, such that only the ones who knows a person intimately are able to understand them. And they can hold false positives, intended to lead the “unworthy” reader astray, believing that he or she has actually understood the message, while actually they’re been tricked to believing it holds something completely different than that which it holds.

I have been working with, and writing a lot about cryptography for the last 5-6 years. In fact much more than most people even realise, because most people would dismiss most of my work as “non-cryptography and unscientific work”. However, maybe that was my purpose …?

If you grew up in the western hemisphere, let me ask you a question. Please give me 4 minutes and 22 seconds of your life, and please give me your entire attention span, and watch the following video. Then let me ask you a simple question …

What does it mean …?

When you understand the answer, don’t answer. That’s the whole point of the exercise! Cryptography is the art of conveying secrets in plain sight, and its purpose is to convey secrets. Let me ask you a simple question …

Can you keep a secret …?

Unless you can, you can never understand what I am talking about, because that was simply my purpose … 😉

BouncyCastle, the only real alternative for cryptography on .Net/C#

BouncyCastle is a group of cyberpunks from Australia, that have created a really kick ass cryptography library for Java and C# (or any other language on the .Net platform).

It’s a kick ass quality piece of work, with tons of features, supporting most standards out there in regards to cryptography. And I freakin’ love it! However, I must admit, that it suffers from an extreme lack of good documentation. You’ll find some information about it over at StackOverflow.com. However, in general terms, you’re basically “on your own” when trying to understand the thing. If you have a lot of spare time though, you could probably dissect its unit tests, to at least get a basic understanding of some of its features, but that’s clearly not for the faint at heart.

Phosphorus Five is using a lot of the features from BouncyCastle. In fact, for the most parts “indirectly” through MimeKit, where Jeffrey Steadfast has done an incredible job at abstracting away the gory details of BC. And I have even gone further to take away the pains, on top of MimeKit again.

Cryptography is one of those things you really should not create yourselves. The reasons are, that a simple bug, might literally mean the difference between life and death for your customers. Hence, instead of using BouncyCastle directly, which is a real pain – I encourage you to at least use it indirectly through MimeKit, or even preferably even through Phosphorus Five. That way, you’ll get a flying start, being capable of easily creating, at the very least some PGP encrypted emails, and creating your own PGP keys, etc – Without running the risk of messing everything up …

Check out the docs for how to get started here – (scroll a little bit down to see how to create your first encrypted email) – Below is a small video I created, that should get you started, within 5 minutes. So what are you waiting for?

Let’s Encrypt!! 😀

EU proposing ban on cryptography backdoors

No more of this please …!!

Finally som sanity! It now seems that EU is trying to push for a new law, which criminalises any attempts at installing backdoors, that will bypass cryptography solutions. Source; The Telegraph. I must say, that this is a surprising turn of events, since a lot of governments have made the exact opposite arguments, for quite some time. I guess they finally realised that it’s ipso facto impossible to keep our government communication secured online, unless they commoditise the same security to their people!

Thank you EU! Thank you very much!! ❤

PS!
Phosphorus Five has tons of cryptographically secured goodies … 😉