SurgeVault Encrypt Feature

The SurgeVault feature allows you to define some rules (per domain) that specify when a message should be encrypted (based on subject, or content or destination etc) and then instead of sending the raw naked message the destination user is either sent an encrypted message, or a link to an encrypted message. In either case the destination user is required to login and set a password to read that and future messages. Then they are either shown the message, or given a key to decrypt the message they were sent.

How to configure/turn on SurgeVault encryption:

  1. Set the global setting G_ENCRYPT "true"
  2. Set a domain level rule for each domain you want to be able to send encrypted messages:
    encrypt_rule header="subject" contains="encrypt:" method="server"
  3. Send an email to someone from the domain in question, with "encrypt:" in the subject.
  4. If you wish to use the feature regularly you will need a new Key to enable this feature (sorry this is a paid add on feature), otherwise it is limited to '2' messages per day!

Inline based encryption

In this mode the message is encrypted, then sent to the destination user as an html attachment which contains javascript to 'decrypt' the message, to obtain the 'key' to decrypt the message the user must login to the sending server and request it. The first time they do this they must set a password. This means the security of 'subsequent' messages is enhanced as the password cannot be 'reset' by the receiving customer. (this applies to the server based method too)

Server based encryption

In this mode the destination user is sent a link containing a key that is needed to decode the message which is kept on the sending server. This is equally secure.

Secure Reply

In either case a secure reply can be sent once the user has logged in to fetch the key or decrypt the message.

Encoding used

AES 256 CBC mode with MD5 hash.

Relevant Settings

Setting Description
G_ENCRYPT "true" Enable Encryption feature.
G_ENCRYPT_EXPIRE "30" Days to keep encrypted messages before deleting
   
Domain based settings
encrypt_rule header="subject" contains="secret" method="server" Specify rule for encrypting messages
encrypt_subject Private message
encrypt_intro Please click on the attached message to read your secret message


Full encrypt_rule settings are:

encrypt_rule header=string contains=string from=string to=string method=string

SurgeWeb integration

In addition to encrypt_rule rule based triggering, the sending of encrypted email is integrated into the surgeweb compose pane. Whilst SurgeVault is prerelease you will need to add this surgeweb setting in order to show the surgevault integration in surgeweb.
encrypt_develop_show true 
This can be at the global (surgemail/surgeweb/config_global.dat), domain (config_domain.dat) or account level (_user.dat).

Also note that there is a setting on the surgeweb customisation page that disables the SurgeVault interface in surgeweb. (this will be primary enable / disable method once the need for encrypt_develop_show is removed)
encrypt_hide true