Welcome to SAFE WEBDROP MESSAGE EXCHANGE

A General Secure Message Exchange Mechanism

Easy-To-Use End To End Encryption

It is often the case that people who are in contact almost every day chose to exchange unencrypted messages (email) about other people and their work, so they risk revealing sensible information unintentionally. The CryptoBone software had been developed to change that, as it provides an easy-to use and also secure way to exchange AES encrypted messages between people.

To ensure true end-to-end encryption, it is necessary to start the exchange with a shared initial secret two people have agreed on and which can be entered into the GUI. Once that has happened, the two users will no longer bother about encryption keys any more.

But how are the encrypted messages transported between the two contacts?

Suppose the two users can use a HTTPS-enabled server to exchange messages. This would reduce metadata and would render an official email-account for that purpose superfluous.

There a some important pre-conditions that the SafeWebdrop exchange mechanism has to meet:

• It should not be necessary to establish everyone using SafeWebdrop as a user on the server.
  The SafeWebdrop programs should be minimal invasive for the server.

• It must be ensured, that senders are authentic and that messages can only be retrieved by the legitimate recipients.

Minimal invasiveness clearly rules out something like the secure shell. It is not desirable to establish users with full server access nor is that necessary for safe message exchange. Nevertheless, in order to safeguard an authentic message exchange, the installation of a user's RSA public key on the server is very much desirable, provided that it can be done with minimal effort.

Personal Contact is Key

Again, the user lives and works in an environment, where direct contact to a server administrator is not difficult. And all the server administrator has to do in order to enable the use of the SafeWebdrop message exchange, is to copy a public key, that has arrived at the server, into a single directory created for that user. Nothing more is needed.

But it must be the correct public key the GUI has produced (and secured) for the user. So one personal contact between a user and the server administrator in which the administrator receives the registration code first-hand ensures, that the user is established on the server in a secure way.

SafeWebdrop is a Secure Foundation

Originally developed for the Crypto Bone, the SafeWebdrop mechanism can be adapted for a large number of projects that require safe message exchange. It is a foundation for intern communication demands that can be satisfied with the willingness to establish a minimal invasive software product on a server, that is already up and running.