Encryption

Caption

Name	Description
private_key encrypted	Private RSA key encrypted with user's password
private_key	Unencrypted private RSA key to decrypt team passwords
public_key	Public RSA key to encrypt team passwords
Clear-text team-password	Password from team as clear-text. Password is a randomly generated AES-256 key
Encrypted team-password	Team-password encrypted with public RSA key
Random transfer-password	Random password generated to encrypt an encryptable which is going to be transferred
Encrypted random transfer-password encrypted	Random transfer-password encrypted with receivers public_key
Clear-text encryptable data	encryptable data(password, username, attachment, token, pin, email, custom attribute) as clear-text
Clear-text encryptable data	encryptable data(password, username, attachment, token, pin, email, custom attribute) encrypted with public with teampassword
Clear-text user-password	Password from user as clear-text
Encrypted user-password	User-password encrypted with public RSA key
User Bob	An example user named Bob
User Alice	An example user named Alice

Encryption technologies

What	Keylength
RSA Keys	RSA 2048
Team Password	AES 256

Create new User

1. A new RSA key pair is generated
2. RSA private key is encrypted with user's password
3. RSA key pair saved as User attributes

User Bob creates new Team

1. Random AES-256 key is generated as team-password
2. Team-password is encrypted with Bob's public key
3. Encrypted password saved as Teammember attribute
4. if private: admins will not have access on this Team

There will be no passwords in the model Team

User Bob adds Alice to Team

1. Encrypted password is decrypted with Bob's private key
2. Team-password is encrypted with Alice's public key
3. Encrypted password saved in new Teammember as attribute

User Bob creates encryptable

1. Encrypted team-password is decrypted with Bob's private key
2. Encryptable-data is encrypted with plain-text team-password
3. Encrypted encryptable-data saved as Encryptable attributes

User Bob reads encryptable data

1. Encrypted team-password is decrypted with Bob's private key
2. Encrypted encryptable-data is decrypted with plain-text team-password

User Bob login

1. Decrypt encrypted private RSA key with Bob's plain-text user-password
2. Save decrypted private RSA key in Session

The private RSA key will never be saved in plain-text except in a session!

Bob provides new LDAP password

1. The user Bob changes his LDAP passowrd
2. Bob login on Cryptopus with his new password
3. A Form will be shown, in which Bob must enter the new and the old password
4. Does Bob remember the old password?
5. If not a new recrypt request will be created
6. Else, decrypt encrypted private key with old password
7. Encrypt private key with new password and save in DB

Root process Bobs recrypt request

1. Root logs in and applies Bob's recrypt request
2. Process all teams with Bob's membership which are accessible by root
3. Decrypt encrypted team-password with root's private key
4. Team-password is encrypted with Bob's new public key

Admin process Bobs recrypt request

1. Admin logs in and applies Bob's recrypt request
2. Process all teams with Bob's membership which are accessible by admin
3. Decrypt encrypted team-password with admin's private key
4. Team-password is encrypted with Bob's new public key

User Bob transfers encryptable

1. Bob wants to share an encryptable with Alice
2. He encrypts the encryptable with a random transfer password
3. Then He encrypts the random transfer password with the public key of Alice
4. Afterward Alice decrypts the random transfer password with her private key
5. With the random transfer password she is now able to decrypt the encryptable
6. The cleartext encryptable is then finally encrypted with the personal team password of Alice