Encrypting mail-in documents upon receipt

HCL Domino Domino Forum
1

Goal: Have all mail delivered to mail-in database encrypted and allow only a few select people access to the contents of that mail file. Mail will be received via the internet from mail systems other the Lotus Notes. Prefer not to setup a dummy user id. Server is running 6.5.3.

Attempt #1

Created private key and assigned to the “memo” form. This didn’t work because the server doesn’t have the secret key. The memo is only encrypted when edited and saved from the Notes Client by a user who has the secret key in their user id file.

Attempt #2

I set the “Encrypt incoming mail” in the mail-in configuration document to “Yes” but didn’t specify a public key on the last tab. There was no encryption. I then selected a user’s key but only that person could then see the encrypted fields. So that’s no good, because we need a select few to see the information.

Attempt #3

Added the field “PublicEncryptionKeys” (text list) to the “memo” form and enter list of people for public keys to use. Mails received were not encrypted until they were edited and saved. No good, the memos need to be encrypted prior to anyone being able to open them.

Attempt #3.5

I combined efforts from Attempt #2 and #3. No luck, still only available to public key used by server (specified in mail-in configuration document).

Attempt #4

I created an agent to run when before new mail arrives. The agent added the item “PublicEncryptionKeys” and its values (fully canonical names). The agent then calls the NotesDocument.Encrypt method and saves the document. I couldn’t get this to work because “unprocessed documents” returned no collection and you can’t use Encrypt for the context document.

Attempt #5

I changed agent from Attempt #4 to run after new mail arrives. Agent processed and encrypted documents (after making some changes to server restrictions, etc.). However, although my user name was listed in the “PublicEncryptionKeys” field (and the form’s properties, I couldn’t get to the encrypted body fields.

I’ve done pretty much all I can think of and most of the things I found in the forums were in regards to sending mail or breaking the encryption, etc. I could have overlooked something but am current at my whit’s end!

2

Subject: Encrypting mail-in documents upon receipt

Chuck,

Encryption is tricky because in order to have the level of security required for encryption, you need the id files. I think you’re stuck with …

#1) Use ReaderNames instead of Encryption. Run an agent to set the ReaderNames fields, that’s easy. Use a [role] that includes your group of users, that’s easy. Now you’re all set and no encryption required.

#2) set the “Encrypt incoming mail” in the mail-in configuration document to “Yes” and select a user’s key. Make that user a bogus user who owns this mail file, and give the id/pw for that id to your group of real users. Now when they want to access this mail file, they have to switch id’s and become Bogus User.

regards,

raphael

3

Subject: RE: Encrypting mail-in documents upon receipt

Thanks for the response Raphael. I’ll have to check if the first suggestion will suffice, it is easy, but most likely we’ll have to go with the second and use a shared dummy ID. I think the requirement must have encryption in use to be approved. I was hoping someone would know of an alternate solution.