Skip to content

feat: handle email encryption via x25519 asymmetric keys #2248

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Carbonhell wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat: handle email encryption via x25519 asymmetric keys #2248

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6288097
feat(email): handle encryption via x25519 asymmetric keys
Carbonhell Feb 10, 2026
e56140d
fix: use specific KDF from blake3 docs instead of handmade one
Carbonhell Feb 14, 2026
88d15b8
tweak(email): update public key and existing encrypted emails (removi…
Carbonhell Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.WRITE_GITHUB_TOKEN }}
MAILGUN_API_TOKEN: ${{ secrets.MAILGUN_API_TOKEN }}
EMAIL_ENCRYPTION_KEY: ${{ secrets.EMAIL_ENCRYPTION_KEY }}
EMAIL_PRIVATE_KEY: ${{ secrets.EMAIL_PRIVATE_KEY }}
ZULIP_API_TOKEN: ${{ secrets.ZULIP_API_TOKEN }}
ZULIP_USERNAME: ${{ secrets.ZULIP_USERNAME }}
CRATES_IO_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
Expand Down
128 changes: 122 additions & 6 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,8 @@ ansi_term = "0.12.1"
atty = "0.2.14"
base64 = "0.22"
chacha20poly1305 = "0.9.0"
x25519-dalek = "2.0.1"
blake3 = "1.8.3"
clap = "4.5"
derive_builder = "0.20.2"
dialoguer = "0.10.1"
Expand Down
12 changes: 6 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,15 +187,15 @@ it. Encrypted email addresses look like this:
encrypted+3eeedb8887004d9a8266e9df1b82a2d52dcce82c4fa1d277c5f14e261e8155acc8a66344edc972fa58b678dc2bcad2e8f7c201a1eede9c16639fe07df8bac5aa1097b2ad9699a700edb32ef192eaa74bf7af0a@rust-lang.invalid
```

The production key is accessible to select Infrastructure Team members, so if
you need to add an encrypted email address you'll need to reach out to that
team. The key is stored in the following parameter on AWS SSM Parameter Store:
The `cargo run encrypt-email` CLI command can be used to encrypt an email address in a self-service manner.
Decryption is automatically done as part of the sync process executed in the CI.

The production private key is accessible to select Infrastructure Team members, and
it is stored in the following parameter on AWS SSM Parameter Store:
Comment on lines +193 to +194
Copy link
Contributor

@ubiratansoares ubiratansoares Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Considering the change we are proposing here, I think we could store the private key somewhere else. Ofc we'll have it as CI secret, but eventually 1password could be an option for infra admins as well, just in case we need to decrypt existing emails and get in touch with people for whatever reason.

Hence, I do think we could simplify a bit this approach. Not sure what other infra admins think about this 👀

Copy link
Author

@Carbonhell Carbonhell Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not familiar with 1password and how you use it, but I think a relevant point is that I can't seem to find the Terraform definition of this parameter on simpleinfra - I assume it was created directly via the AWS dashboard. This might be an extra point in favor of using 1password to remove this parameter that isn't currently managed under IaC

Copy link
Contributor

@ubiratansoares ubiratansoares Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We decided to stick with AWS SSM rather then using 1password to keep a copy of the private key. I think it'd be fair to mention the new CI secret we'll introduce with thie PR alongside with the updated parameter as part of this doc.

I'll share the new parameter here as soon as I have it. We'll manage this secret using Terraform


```
/prod/sync-team/email-encryption-key
```

The `cargo run encrypt-email` and `cargo run decrypt-email` interactive CLI
commands are available for infra team members to interact with encrypted
emails. The `rust_team_data` (with the `email-encryption` feature enabled) also
The `rust_team_data` (with the `email-encryption` feature enabled) also
provides a module to programmatically encrypt and decrypt.
2 changes: 1 addition & 1 deletion people/camelid.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ name = 'Noah Lev'
github = 'camelid'
github-id = 37223377
zulip-id = 307537
email = "encrypted+ebe6f3cec2ee373b57408f88ad0f14dc86c1f1bfaf7829aa5628073ae74e78ae52bc02b1b3ae221ed92284b923258b53a2572142cd62de3f92244cb7045d9058@rust-lang.invalid"
email = "encrypted+02728fc388dadf662dc77fcec3e7c6d5ed7ae47a92026fc9c75744c45b9427564b4123afcacfdc46a5b0a8a8ebc414adecdd37d617e0a6cea3678488ea95fc84634266bebba24e96d44fd7b7f9fc5c5545eeb8650d5c19582797c70a39c30507@rust-lang.invalid"
4 changes: 3 additions & 1 deletion rust_team_data/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,12 @@ license.workspace = true

[dependencies]
chacha20poly1305 = { workspace = true, optional = true }
x25519-dalek = { workspace = true, optional = true, features = ["getrandom", "static_secrets"] }
blake3 = {workspace = true, optional = true}
getrandom = { workspace = true, optional = true }
hex = { workspace = true, optional = true }
indexmap = { workspace = true, features = ["serde"] }
serde = { workspace = true, features = ["derive"] }

[features]
email-encryption = ["chacha20poly1305", "getrandom", "hex"]
email-encryption = ["chacha20poly1305", "x25519-dalek", "blake3", "getrandom", "hex"]
Loading