{"id":1137,"date":"2018-11-28T10:53:09","date_gmt":"2018-11-28T09:53:09","guid":{"rendered":"https:\/\/reddcrypt.hostpress.me\/?page_id=1137"},"modified":"2020-09-14T14:17:22","modified_gmt":"2020-09-14T12:17:22","slug":"technology","status":"publish","type":"page","link":"https:\/\/www.reddcrypt.com\/en\/technology\/","title":{"rendered":"Technical Overview \u2013 how REDDCRYPT works"},"content":{"rendered":"

Technical overview<\/span><\/h1>\n

\u00a0How REDDCRYPT works<\/h2>\n

REDDCRYPT is based on the PGP encryption method. This means that our solution works with a respective certificate pair – consisting of a private and a public key.\u00a0However we solve the biggest problem that the established standards have: they are not operable for a “normal” (non-technical) user!<\/strong><\/p>\n

The difference between REDDCRYPT and other solutions: The entire handling of the certificates takes place automatically in the background. No user ever has to deposit a certificate somewhere or even know how the technology works. And with this approach we make e-mail encryption usable for everyone<\/strong>!<\/p>\n

On this page we explain to you in detail and completely transparently how the encryption and decryption of REDDCRYPT works.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Quick overview: This happens at REDDCRYPT<\/span><\/h3>\n<\/div><\/div><\/div>

REDDCRYPT automatically encrypts your emails on your device before they are being sent. Thus, your emails and their contents remain private. This way you can securely send sensitive information via email.<\/span><\/p>\n<\/div><\/div><\/div>

<\/span><\/div><\/div><\/div>

You authenticate yourself on the REDDRYPT app with your email address and a password. A key pair comprising of public key and private key is automatically generated. Your private key is then encrypted with a password hash and uploaded to our servers together with your public key.<\/span><\/p>\n

Sounds too complicated? Don’t worry as most of this happens in the background. You only need to enter your email address and choose a password to generate the key pair.<\/span><\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div>
<\/span><\/div><\/div><\/div>

Writing an email happens locally on your device. Why is this important you may ask? Because only you can read the contents of the email as the process happens locally. Before sending the email it is automatically encrypted on your device.<\/span><\/p>\n

If the recipient is also a REDDCRYPT user, the encryption takes place with the public key of the recipient. This means that you don’t have to take action, as everything happens automatically in the background.<\/span><\/p>\n

If the recipient is not a user of REDDCRYPT yet, you will have to define a passphrase for this first mail<\/strong> with which the recipient can decrypt the mail. To make sure that only the intended recipient can read your email. you can disclose this passphrase to the recipient e.g. via sms or phone call.<\/span><\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div>
<\/span><\/div><\/div><\/div>
<\/span><\/div><\/div><\/div>

To be able to read the email the recipient authenticates on the REDDCRYPT app, as well. If he already has access and the email has been encrypted with this public key, then the recipient can open, read and answer your mail right away. If he didn’t have access yet, he will have to generate his own key pair to through his email address and a chosen password. Afterwards he can see your encrypted email which can be encrypted by entering the passphrase you have disclosed to the recipient earlier (e.g. via sms or phone call).<\/span><\/p>\n

This passphrase is only necessary for the decryption of the first email. With every email that comes afterwards the encryption and decryption process takes places automatically in the background. Highest user comfort and highest security – this is REDDCRYPT.<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>

In detail <\/span><\/h3>\n

Creating a key pair at the beginning<\/h3>\n<\/div>
<\/div><\/div><\/div>

Every REDDCRYPT user generates a key pair when first using REDDCRYPT. This RSA key pair consists of a private and a public key and is generated from the combination of the user’s email address and a chosen password.<\/p>\n

The generation of the key pair takes place locally on your device.<\/p>\n

\"Register<\/p>\n

After confirming that the User is the owner of the email address, he\/she assigns his\/her personal password. This password is used to encrypt the users private key<\/strong> and at the same time a password hash<\/strong> is generated from this password via a key derivation.<\/p>\n

The password hash\u00a0<\/em>is necessary to authenticate the user in the REDDCRYPT app. We use a hash value so that the actual password of the user is never transferred and not stored in our database. Furthermore, a hash value is much more secure as it has higher entropy – more randomness – compared to passwords in plain text.<\/p>\n

The encrypted private key is transferred to REDDCRYPT together with the public key.<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>

Data protection: What data we store and how we protect it<\/span><\/h3>\n<\/div>
<\/div><\/div><\/div>

Fundamentally, the REDDOXX App serves to store and transfer encrypted emails. For our service to work smoothly and on different devices we have to store some data.<\/span><\/p>\n

Email Address<\/span>
\n<\/strong>The email address is required to log in to the REDDCRYPT app.<\/span><\/p>\n

Public Key<\/strong><\/span>
\nWe store your public key unencrypted. This is uncritical as public keys don’t contain any sensitive information. It is in their nature to be unencrypted so that other users can use them to send you encrypted emails.<\/span><\/p>\n

Private Key<\/strong><\/span>
\nYour private key has already been encrypted locally on your device with your password. This encrypted private key is transferred to us and stored securely.<\/span><\/p>\n

Password Hash<\/strong><\/span>
\nIn order to encrypt and decrypt an email the REDDCRYPT user’s password is mandatory. This password has already been hashed on your device and is hashed again on our servers.<\/span><\/p>\n

Encrypted Email<\/strong>
\nTo improve the user experience we store encrypted mails on our servers. This allows recipients to access and read emails instantly from any device via web browser. Emails have already been encrypted in a container on your device before being transferred to us.<\/span><\/p>\n<\/div>

What if REDDCRYPT were hacked?<\/h2>
The simple answer: nothing!<\/b> As all data on our servers is additionally encrypted potential attackers would only be able to see your email adress and 'waste data'. It is impossible to restore or calculate the real plain text password from the password hash stored on our servers. This ensures that a hacker would be unable to read the encrypted emails because he would require a user's password to decrypt the private key (and the emails respectively).<\/div>
<\/div><\/div><\/mask><\/g><\/g><\/clipPath><\/filter><\/defs><\/svg><\/div>
<\/div><\/div><\/div><\/div><\/div>

Zero knowledge \u2013 Full control over your emails<\/h3>\n<\/div>
<\/div><\/div><\/div>

REDDCRYPT is a so-called zero-knowledge provider<\/strong>. All private and sensitive information are fully encrypted before being transferred to REDDCRYPT. The important thing about about the zero-knowledge\u00a0technique is the fact that we neither know your password\u00a0 nor is it being transferred to us at any point. Thus, we do not have access to your emails.<\/p>\n

The encryption and decryption of your emails happens 100% locally on your device.
\n<\/strong><\/p>\n

Every decryption starts with the user’s password which is necessary to decrypt the private key, which – again – is necessary to decrypt the encrypted email.
\nThis is further evidence of the zero-knowledge technique as your keys, despite being stored on our servers, can only be used in combination with your password.<\/p>\n

Only your public key is stored unencrypted on our servers so that other REDDCRYPT users can use it to send you encrypted emails.<\/p>\n<\/div>

<\/div><\/div><\/div>

Security – Your password stays with you<\/h3>\n<\/div>
<\/div><\/div><\/div>

As mentioned, the encryption and decryption of the emails only works if you authenticate with your email address and password in the REDDCRYPT App. Your password never leaves your device. <\/strong>As part of the zero-knowledge technique<\/p>\n

Your password is needed in two cases: To authenticate in the REDDCRYPT app and to decrypt your private key. As part of the zero-knowledge technique a\u00a0password hash<\/strong> is generated from your password through key derivation.<\/p>\n

When logging in to the REDDCRYPT app a password hash is derived from the combination of your email address and a password and then transferred to us. If the hash value matches the hash value stored on our servers, access to your encrypted emails will be granted. If the hash value does not match access will be denied.<\/p>\n

In order for the emails to be automatically decrypted on your device the password is used.<\/p>\n<\/div>

<\/div><\/div><\/div>

The authentication process for accessing the REDDCRYPT app<\/h3>\n<\/div>
<\/div><\/div><\/div>

If a user accesses the REDDCRYPT app, the following happens:<\/p>\n

    \n
  1. A password hash is derived from the password entered on the user’s device<\/li>\n
  2. The entered email address and password hash are sent to the REDDCRYPT server<\/li>\n
  3. The password hash is hashed again on the server<\/li>\n
  4. On the server the hashed password hash is compared to the hash value stored in our database. If both values match, the entered password is correct and the user’s authentication is successful.<\/li>\n<\/ol>\n

    If the user’s authentication is successful he is granted access to the encrypted emails. To decrypt these emails the private key is needed which is automatically downloaded in the background to your device and decrypted with the password.<\/p>\n<\/div>

    Why happens when clicking the 'Forgot Password' option?<\/h2>
    Since your password does not leave your device and is completely unknown to us there is no way we can recover your password. So what happens if you generate a new password via \"Forgot password\"?\n\nWhen you generate a new password you will be treated like a new user and new certificates (including password hash and password key) will be generated for you - of course fully automated.\n\nPlease note that you can no longer decrypt your old emails when new certificates are generated.<\/div>
    <\/div><\/div><\/mask><\/g><\/g><\/clipPath><\/filter><\/defs><\/svg><\/div>
    <\/div><\/div><\/div><\/div><\/div>

    Functionality: Client-side encryption<\/span><\/h3>\n<\/div>
    <\/div><\/div><\/div>

    After successful authentication a random session key is generated on the user’s device with which the email is encrypted for the first time. To make sure that nobody else besides the recipient gains access to the email’s content, the session key is also encrypted.<\/p>\n

    Recipient is already REDDCRYPT user
    \n<\/strong>Upon entering the recipient’s email address a request is send to REDDCRYPT’s key server. If the recipient is already a user of REDDCRYPT, his public key is already stored on our servers and is downloaded to encrypt the session key.<\/p>\n

    \"If<\/p>\n

    Recipient is not yet a REDDCRYPT user
    \n<\/strong>If no public key is available for the entered email address the sender has to define a random passphrase with which the session key is encrypted.<\/p>\n

    \"If<\/p>\n

    On Sending<\/strong>
    \nWhen the REDDCRYPT user clicks send<\/em> the encrypted email and the encrypted session key are bundled in a container which is then transferred to the REDDCRYPT server.<\/p>\n<\/div>

    <\/div><\/div><\/div>

    Functionality: Client-side decryption<\/span><\/h3>\n<\/div>
    <\/div><\/div><\/div>

    How the email is decrypted depends on whether the recipient has already been a REDDCRYPT user at the time of the email’s sending.<\/span><\/p>\n

    The recipient is already a REDDCRYPT user and has a key pair<\/strong><\/span>
    \nAfter the recipient’s successful authentication on the REDDCRYPT app the private key and container are downloaded. Afterwards, the private key is decrypted with the password. The password is now used to to decrypt the session key.<\/span><\/p>\n

    The decrypted session key is used to decrypt the encrypted email. The complete process takes place in the background and the email opens automatically afterwards.<\/span><\/p>\n

    \"Mail<\/p>\n

    The recipient is not a REDDCRYPT user yet and does not have a key pair<\/strong><\/span>
    \nThe user generates a key pair for authentication on the REDDCRYPT app. This process is similar to a traditional registration process for the user. Afterwards the user authenticates on the REDDCRYPT app and the container is downloaded in the background.<\/span><\/p>\n

    As the session key has not been encrypted with a public key but with a passphrase this passphrase is needed for decryption. After the passphrase is correctly entered the decrypted session key is used to decrypt the email.<\/span><\/p>\n

    \"Enter<\/p>\n<\/div>

    <\/div><\/div><\/div><\/div><\/div>

    REDDCRYPT Business and the Master-Key<\/h2>\n

    Administrators of REDDCRYPT Business can create a master key for their organisation and thus protect their own company against data loss.<\/p>\n

    Because this master key enables the decryption of all emails of the own company, a requirement that occurs again and again, especially after employees have left the company. The master key also enables employees to create a new password if they forget their old one.<\/p>\n

    This is changed by the Master-Key<\/h3>\n

    If an organisation has a master key users’ private keys are no longer encrypted directly with the users password.<\/p>\n

    From the user’s entered password – from which the password hash was derived at the beginning – a further hash value is now determined: a password key<\/strong>. In the future the users private key will be encrypted with this password key instead of the password.<\/p>\n

    The creation of the Master-Key<\/h3>\n

    If a Master-Key is created basically the same happens as when creating a REDDCRYPT account: If the administrator creates a master key it is created locally on the administrators device.<\/p>\n

    In addition the administrator defines a password from which a password key is derived here as well. With this password key the master key is encrypted and transferred to our servers in encrypted format.<\/p>\n

    Again without the password defined by the administrator the master key cannot be used. This is an essential part of the Zero-Knowledge technology and does not differ from the process described above which is applied to the user keys. Since the defined password is never transmitted to us only you can use the master key.<\/p>\n

    This is how the Master-Key works…<\/h3>\n

    If an organisation has a master key the users password key is additionally encrypted with this master key. So in the future there will be two ways to decrypt the users private key: By the users password input and by the master key.<\/p>\n

    …if emails should be decrypted<\/strong><\/p>\n

    For example if e-mails from employees who have left the company need to be decrypted this can be done using the master key.<\/p>\n

      \n
    1. To do this the master key has to be decrypted using the password created by the administrators<\/li>\n
    2. Afterwards the decrypted master key is used to decrypt the users password key<\/li>\n
    3. The decrypted password key is used to decrypt the users private key<\/li>\n
    4. The decrypted private key is used to decrypt the email.<\/li>\n<\/ol>\n

      We have described how the complete process looks like in practice in our Knowledge Base: https:\/\/www.reddcrypt.com\/en\/knowledge-base\/decrypt-emails-of-former-employees-with-the-master-key\/<\/a><\/p>\n

      … if passwords are forgotten<\/strong><\/p>\n

      If a user has forgotten their password they can generate a new password without losing access to previously encrypted emails. During the development phase it was important for us that the administrators do not know the user passwords so we developed a process that allows the user to define his new password on his own.<\/p>\n

      To do this the user creates a new password using the “Forgot Password” function which is first stored temporarily in encrypted form. To use the new password the users private key must be decrypted and then re-encrypted with the new password.<\/p>\n

        \n
      1. The administrator enters the password of the master key to decrypt it<\/li>\n
      2. With the decrypted Master-Key the (old) password key of the user is decrypted<\/li>\n
      3. The decrypted password key is used to decrypt the users private key<\/li>\n
      4. A new password key is generated from the users new password<\/li>\n
      5. The users private key is encrypted with the new password key<\/li>\n
      6. The password key is encrypted with the master key<\/li>\n
      7. The process is finished and the new password can be used for login from now on<\/li>\n<\/ol>\n

        How the whole process looks like in practice we have described in our Knowledge Base: https:\/\/www.reddcrypt.com\/en\/knowledge-base\/resetting-password-with-master-key\/<\/a><\/p>\n<\/div><\/div><\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"footnotes":""},"class_list":["post-1137","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/pages\/1137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/comments?post=1137"}],"version-history":[{"count":11,"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/pages\/1137\/revisions"}],"predecessor-version":[{"id":5194,"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/pages\/1137\/revisions\/5194"}],"wp:attachment":[{"href":"https:\/\/www.reddcrypt.com\/en\/wp-json\/wp\/v2\/media?parent=1137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}