Clavimit — LucaB

Clavimit is a Firefox extension for encrypting and decrypting Gmail messages using client-side cryptography.

It uses hybrid encryption with AES-256-GCM and RSA-OAEP with SHA-256. Encryption and decryption are performed locally in the browser using the Web Crypto API.

Clavimit does not require an account or a Clavimit server.



When encrypting a message:

1. Open Clavimit.
2. Open the encryption section.
3. Provide the recipient's RSA public key by:
4. pasting the key, or
5. selecting a public-key file.
6. Choose a compose mode:
7. Gmail compose - encrypt the message currently written in Gmail.
8. Secure compose - write the plaintext message directly inside Clavimit. Clavimit opens a Gmail compose window automatically and inserts only the encrypted message.
9. Optionally enable Keep a decryptable copy for the sender and provide the sender's RSA public key.
10. Click Encrypt.

Clavimit generates a new AES-256 key for each message and encrypts the email content using AES-GCM.

The AES key is encrypted using the recipient's RSA public key with RSA-OAEP. If Keep a decryptable copy for the sender is enabled, the same AES key is also encrypted using the sender's RSA public key. Encrypting the AES key separately for the recipient and sender allows either party to decrypt the same encrypted message using their own RSA private key.

The encrypted email contains the information required for the recipient to decrypt it, including:

• the encrypted AES key
• the encrypted AES key for the sender, when enabled
• the initialization vector (IV)
• the encrypted message
• the algorithm identifiers
• the Clavimit message-format version

Encrypted messages are wrapped in a Clavimit message block:

-----BEGIN CLAVIMIT MAIL-----
...
-----END CLAVIMIT MAIL-----



To decrypt a Clavimit message:

1. Open the encrypted email in Gmail.
2. Open Clavimit.
3. Provide your RSA private key by:
4. pasting the key, or
5. selecting a private-key file.
6. Click Decrypt.

Clavimit attempts to decrypt the message AES key using the provided RSA private key. If the message contains both recipient and sender encrypted-key copies, Clavimit automatically uses the one that can be decrypted with the supplied private key.

The recovered AES key is then used to decrypt the email content.

The resulting plaintext is displayed by the extension.

The Keep a decryptable copy for the sender feature allows the senders to decrypt their own messages from Gmail's Sent section.