Encrypted fields not encrypting

HCL Domino Domino Forum
1

Hi

I’ve got a form with one encyrpted rich text field (i.e. “Enable encryption for this field” turned on) and no encryption keys associated with the form.

I create a new document with the form, save the form, and then and on the document properties, set the “Public Encryption Keys” to include another user, and save the form again (becuase until the form is saved, you can’t added any keys).

I close the database, switch to another id, not the one I added to the public key list and reopen the database.

All users are members of a group that has author access to the document through an author field, and all users have author ACL access (excpet mine which has manager access).

When I try to open the document, I get the message that I’ll be unable to read parts of the document because I don’t have the necessary keys (as I expect) but the encrypted field is still readable. It’s also readable in the list of fields in the design property sheet for the document. I can’t edit the document, as expected.

BUT I should not be able to read the contents of the encrypted field.

If I edit the document with the original ID i created it with, and try and remove the public key from the document, notes crashes when trying to display the property page where you add and remove public keys.

Yesterday I had made the same field on the same form encrypted and it worked properly. Then I deceded to do away with the encrypted field. This morning I make the same field encrypted again to check the feature out some more and this is what’s happening.

Any suggestions?

Thanks in advance.

Mohib

2

Subject: NotesDocument.Save doesn’t preserve field encryption!!!

I’ve found the problem, but don’t know how to fix it:

NotesDocument.Save does not preserve field encryption.

If I have a document with an encrypted field, set public keys set for the document when I create it, and then save the doucment (using File/Save) but keep document open, the document is saved and is encrypted on disk.

I can tell it’s encrypted on disk because if I check the fields listed in the document’s design property sheet when I pull up the property sheet for the document from the view, the encrypted field is not listed. (As expected, the field does appear in the document’s design property sheet if I pull up the property sheet from the still open document).

However if I now do a function which causes a NotesDocument.Save to take place while the document is still open, the document is saved but the field is not encrypted on disk. I can tell by opening the property sheet, as above, from the view – the field appears in the property sheet.

I have a locking mechanism for documents being edited which prevents multiple users from editing the same document at the same time (and so reduces save conflicts on a given replica).

I do a NotesDocument.Save on QueryMode change or open direclty to edit made to set the lock, and again on Terminate to reset the lock.

The document remains encrypted on disk until the user switches to edit mode and the NotesDocument.Save to set the lock takes place. Right after the NotesDocument.Save, the document is no longer encyprted on disk.

Same when the lock is reset when the user closes the document. While it is open and he saves it using File/Save it remains encrypted on disk until the NotesDocument.Save takes place in terminate to reset the lock. This second NotesDocument.Save takes palce in an agent called from the form terminate event, so technically the form is not even open. The agent is passed the UNID of the document via an INI variable so it’s unaware it was open, and we just have an agent doing a NotesDocument.Save.

Any body else run into this problem with losing encryption when a NotesDocument.Save??

TIA

Mohib

3

Subject: Try calling NotesDocument.Encrypt before NotesDocument.Save

4

Subject: Try calling NotesDocument.Encrypt – sort of helped, but there are bigger problems …

Thanks.

I tried it and it sort of worked.

When I set my document lock, Notes complains that I can’t use NotesDocument.Encrypt on a document instantiated as a UIDoc, so I tried NotesUIDocument.Save (which mimics a user save off the menu–almost) but that doesn’t encrypt the document, although a user save off the menu does.

I can use NotesDocument.Encrypt in the agent that does the unlock, and that works fine.

So…while the document is being edited, it’s decrypted and that would sort of be ok, as long as no-body knew that was a hole,

BUT

half the time the encryption doesn’t even work peroperly.

All I have do is create a new document, add another user’s public key, switch to that user and open the document and it stays encrypted. I, as the document creator can access it fine however. When I add the other user’s public key, his name is added to the “PublicEncryptionKeys” notes item, but the user can’t decrypt the document.

And the similar random access or denial happens as you change which public keys are used to encyrpt, espically if you do this from a view directly.

And many times Notes just plain crashes if you have public keys set and try to pull up the property sheet where you set public keys.

I remember it was finnicky like this back in 4.6x and it’s too bad it hasn’t change much two versions later.

I agree with Chuck, encryption has always been very flaky and finnicky – not worth the hassles and user support for something that is very good but not working as implemented.

5

Subject: Background info on encryption

This link gives some useful info to help how the encryption process actually works.

http://www-10.lotus.com/ldd/today.nsf/0/24d3f7b03bcaf0c388256abb00730519?OpenDocument

6

Subject: RE: NotesDocument.Save doesn’t preserve field encryption!!!

Interesting problem. Eccentric behavior like this is why I’ve always tried to stay as far away from field encryption as possible. Luckily, I’ve always been able to find a workaround to the business problem that encryption is intended to solve using a different technique.