Current version: 0.1

Diese Seite ist nur auf Englisch verfügbar. (Sie darf aber gerne auf Deutsch kommentiert werden.)

Subrosa is a WordPress plugin that allows to encrypt the contents of your contact form via JavaScript, thus granting security from the very beginning of the transmission. Subrosa is designed to work with all WordPress contact forms, provided you install it as described below and a few requirements are met. But it has only been tested with the legacy WP Contact Form and with Contact Form ][. So please report your experiences with other contact forms. Regarding e-mail clients, I have only tested it with Evolution so far; I'd also be glad to receive feedback concerning the mail client experience.

The Subrosa plugin is Free Software licensed under the GNU GPL.

Overview

  1. Installation
  2. Translations
  3. Background
  4. What else?

Before you start

Encryption can significantly improve your privacy and security. But you should have at least some basic understanding of the technology of Public Key encryption. You might want to read a nice Wikipedia article on Public Key encryption, and you will additionally find valuable information in the section Background below.

If you don't have a PGP Key pair yet, you need to create it, for example with gpg4win, Enigmail or some other GnuPG frontend. This is not hard, and you will find advice on how to achieve this on the respective web sites.

Once you have a key pair, you can proceed with installing this plugin.

Installation

Download

Please consider coming back for a donation. You'll support our efforts and receive a backlink.

Have problems unpacking archives? Try the latest 7zip.

... is a 5-minutes-breeze:

  • Download the plugin
  • Unpack it and upload the folder subrosa to your plugins directory
  • Make sure that your theme's header.php is not missing the wp_head() hook.
  • Open your contact form plugin in a text editor and replace the word mail with ctsr_mail in the call to the mail() function. (This line you're looking for will look something like mail($to, $subject, $message, $header).)
  • Export the public key to the e-mail address you use for the contact form and save it as pubkey.asc in the plugin's directory.
  • Open the file subrosa.php and edit the settings at the beginning of the file. The defaults should work with Contact Form ][. Most important is the $ctsr_cftag variable.
  • While you’re there, you can edit the styles that are applied automatically to the encryption section (only if $ctsr_do_autostyle is set to true).
  • Activate the plugin in your admin panel, go to your contact page, and be amazed.

There is also an illustrated and very detailed howto by Kai Schott. If you feel overstrained with the above instructions, you should have a look at his tutorial.

Background

Some words on security

Public Key encryption allows the sender to encrypt a message with a publicly available key and without a password. This so called Public Key is complemented by a so-called Private Key, which must be kept secret by the owner. Because of the two-fold approach, this method is also known as asymetric encryption. It can be considered extremely secure – so secure that even the CIA couldn’t read your message, at least not within the next 100 years (although this depends on the key length).

However, there is still a little chance for an attacker to subvert your communication: If he succeeds to change the public key (e.g. by hacking your server or performing a man-in-the-middle-attack), he might get the sender to encrypt confidential data with a fake key – preferably his own. Therefore, if you need 100% security, you should arrange a phone call with the sender and compare the so-called fingerprint of the key. If it is not identical, you are very likely to be eavesdropped.

Hints on using the Subrosa plugin

Usually, the encrypting is done by an application like GnuPG, most likely via an integration in a mail application (like Enigmail for Thunderbird). This is sometimes a bit complicated for unexperienced users: They need to setup the applications, import the Public Key, apply encryption. The Subrosa plugin allows to encrypt a message at the push of a button. This is done with JavaScript, a leightweight and cross-browser programming language. The public key is delivered to a webpage visitor, and the encryption will take place at the very beginning of the transmission.

The Subrosa plugin supports Public Keys of both RSA and Elgamal. I personally prefer Elgamal, because in opposite to RSA it is a patent free algorithm, and I detest software and algorithm patents. However, with the Subrosa plugin, there are a few issues with Elgamal. First, Elgamal keys can make problems in several browsers. For example, Opera, Internet Explorer and Konquror need very much time and even complain about a broken JavaScript, which can be very unpleasant. Also, due to its nature, an Elgamal key can have two fingerprints. When comparing them, you should be sure, they are generated by the same application – in this case by the extractor, which is included with the plugin and displayed at the bottom of the encryption form.

Why encryption?

To understand the benefits of encryption, you must understand how your electronic communication can be eavesdropped. You should know that sending e-mails is like sending a postcard – everybody can read it. If you’re in an office, your co-workers or your admin could have a network analyzer like Wireshark installed. This is a very useful tool, but – better: because – it allows to read all data transmitted within a subnetwork (under certail circumstances). You should also know that the administrators of your mail server also can read all mail. Also, if somebody installed malicious software on your computer (like a worm or a trojan horse), they might be able to read your mail. Of course, you can trust all these people, but sometimes it is even beyond their reach to secure you privacy (For example if your mail server is being cracked).

You have nothing to hide, you say? You do, believe me. Confidential information can be of many fashions. For example if you need somebody to help you with your website, you will need to send your access data, and you will not want to have them read by others. Or if you write an e-mail to your wife, you don’t want your co-workers or admin to read it. Or maybe you want to mail with your business partners about a great deal? You better use encryption, or you might get unhitched. If you think that this doesn’t apply to you, you might want to read a chapter or two about industrial espionage. You will see, everybody sometimes needs to protect his or her privacy.

Translations

There are localized versions available in

  • German: (included with the plugin download)

If you want to translate the plugin to your own language, please grab the ctsr.pot, fill in the empty fields and compile it with a tool like poEdit. Please don’t forget to send me a copy, so I can make it available to others.

Credits

This plugin is based on the work of a couple of other authors. I want to especially thank Herbert Hanewinkel, who did not only do most of the JavaScript implementations of the cryptographic algorithms, but who also helped me with the development of this plugin. Not to forget that much of the frontend stuff is derived from his insightful online demo.

See the plugin working

The Subrosa plugin can be seen in action on our Contact page.

What else?

Feedback and improvments are as always highly welcome. Please leave a comment below. That’s it! Have a lot of fun with the Subrosa plugin!

In case you need individual, advanced support: Zirona also provides professional support for this software and its integration on your website (as well as WordPress support in general). Please don’t hesitate to contact us and ask about our services.

30 Kommentare zu „Subrosa — Encrypted contact forms for WordPress“

  1. missi am 27. November 2006 um 16:55 #

    Works for me. :)

  2. Alex Günsche am 27. November 2006 um 17:33 #

    That’s good to hear.
    And thanks for mentioning the plugin on your site.

    :-)

  3. Dave Vogt am 28. November 2006 um 00:52 #

    Around line 181 of subrosa.php a CDATA block gets opened. For some reason my WP is forcing the closing to become ]]> instead of ]]> as it is supposed to be. I’m using Comment Form ][, and I can’t figure out why this is happening. Luckily there is nothing in that cdata section that xml would try to parse, so I just nixed the opening and closing of cdata and it works fine.

  4. Alex Günsche am 28. November 2006 um 01:25 #

    Hi Dave, thanks for the clue. I’ll take a look at it.

  5. Kai am 29. November 2006 um 17:53 #

    Thanks for the Subrosa plugin. Now I am having a contact form that supports encryption.

  6. Alex Günsche am 29. November 2006 um 18:24 #

    Hello Kai,

    glad you like the plugin. And I allowed myself to add a link to your great tutorial to this page. Thank you very much for that. I hope, it convinces some more people to give encryption a chance.

  7. Chris Koester am 8. December 2006 um 01:58 #

    Thanks for the great plugin! I much prefer encrypted communications and this makes it very easy.

    I’ve successfully tested the plugin with Thunderbird + Enigmail. Works like a dream.

  8. Chris Koester am 8. December 2006 um 02:25 #

    I neglected to put this in my first comment.

    One minor snag that I ran into – make sure that the folder in the plugins directory is called subrosa and not subrosa0.1, otherwise it won’t be able to find your key.

  9. Alex Günsche am 8. December 2006 um 14:00 #

    Hi Chris,

    glad you like the plugin. As for the folder name, this must be a problem with one of your applications. The folder inside the packed file is already called subrosa and usually it will also be found under this name once you unpack it. I suppose you did something like “Unpack to subrosa-0.1″ instead of simply “Unpack”.

  10. Kenneth Carlson am 8. February 2007 um 00:07 #

    Is there a way to have a single submit button that encrypts and then sends message? We would like to have it set up to only allow encrypted email (web site is for a health clinic).

    BTW Thanks for making this. We were imagining such a capability but we didn’t have the programming skills.

  11. Alex Günsche am 8. February 2007 um 12:53 #

    Kenneth, please see the e-mail I wrote you yesterday.

  12. ce am 22. March 2007 um 16:03 #

    Hello.
    We’re lucky to find the subrosa-plugin but unfortunately it doesn’t work for us. We installed it as suggested, but if we click the encrypt-button, an error message pops up and says “Der öffentliche Schlüssel scheint beschädigt zu sein.” / “The public key seems to be broken.”.

    Our suggestion is, that it doesn’t work because we have a DSA-key.
    Any other suggestions?

    Tnaks.
    ce

    PS: Sorry for the bad english.

  13. Alex Günsche am 22. March 2007 um 17:29 #

    No Problem wegen the schlecht English. Kannst auch ruhig deutsch schreiben. ;)

    Eigentlich sollte es auch mit DSA-Schlüsseln klappen. Besser sind jedoch RSA-Schlüssel, optimalerweise 768 oder 1024 Bit lang.

  14. james am 23. June 2007 um 02:29 #

    i have followed all of the install instructions, but i get the following error when i click on the encrypt button,

    “Public Key appears to be broken”

  15. Alex Günsche am 25. June 2007 um 10:35 #

    Which type of key do you use, RSA or DSA/El-Gamal?
    Can you give me a link to your page?

  16. james am 29. June 2007 um 20:33 #

    Alex,

    I took the page down as it wasn’t working. I’ll paste my key here, it is DSA/El-gamal (1024)

    —–BEGIN PGP PUBLIC KEY BLOCK—–
    Version: GnuPG v1.4.4 (Darwin)

    mQGiBEM2xwQRBADWDQILT4Q9ekbkT736GjBWl+0Fu4ma2bW0P9rkhyiY+E7gckxD
    FRWxcU2+1kUipRJ/zxRF8SxhWlLWlMM6TkHVsL+2gfwKRvs1vJ/IcgtgBzNYBHla
    Iaj73RULLoqsGFvPLqNI6z0eryfLCdZ2G/iCblbsmV245lDR4qw5Ifpq7wCgz+dU
    aSIEpjo6sMFuvHc2cFZxwPkEAJkfEHz08Tj5a47onlvaX3JBRQrcdCdf03NJY8pa
    W+k8oabW0SWq1XvCegwbIUsHmJ4q4pLfp4buU5pg93sG8AabzTmU/3jQZ+cyuUbS
    Sujj0aK/D0dfJOknK3YDkW6F1bWaxeRTacFiMsgUXnUEZYuN836z/2J6/PHk2R7Q
    a8WuA/4pXpLBBK4h+Tv6oSxZeXqZo6ylYkdZSgh75Y3lUZ/efyKLiq8ovILyZM0W
    auOA854WqV8RVOwO0HM0cmrunG340ROJl2rSoDk7JAfpY+Jmb8bI9LqQGsKeIPHN
    a0v4RBiQ2LOGdoZqAntHSw9VqTGB6pe+L9DFjaiFpyiIcT1H/7QqSmFtZXMgQ3Jh
    aWcgPGphbWVzLmNyYWlnQGpvaG5ueXJveWFsZS5uZXQ+iFsEExECABsFAkM2xwQG
    CwkIBwMCAxUCAwMWAgECHgECF4AACgkQK+NTKxRw/c3w3wCgkc1W/rQEjCKMmFDq
    452XnwNdQygAoLA2p4IguVFhQEpSf1TsCLr4RXYuiEYEEBECAAYFAkZ8drYACgkQ
    Aod8xLG6umvBxwCdFihhLZAqBcLhk1e+Y2LgTqSLgFgAnjHCNeP2xzl5yGrq8slU
    zo2FF4k9uQENBEM2xwkQBACJzlp+akz9xtCI2TgbBYlBE2kbWY+ewO0qZf4mJVYu
    t41uMiDusZ7JCdKyBRgarEKu7XrCrtwo8beXE1Aev1cRdfEEiM2fKSgPGLRe+J5i
    r1lc34O+2bo4jCJHFxAVh1Mrf24p2yLZ144NYjthHJDS3k5YJpwdbgpLRHXugzBv
    pwADBQP/cBTllUDKjV1CIQaiDXh3RVXEKSFeSf4S8oTrCgCQchd6tONSa1nG3+j3
    okNppGimeKanUQ1Ylx09KXNEPmO7wPA3cNGoEoNpiEHrC/jF6aYNV0SJ4/pQb/mp
    Aul4pBhZ2Kjia5/IiLDPdNk4TjaArgVI+oCDmPW2o32uWt0msGKIRgQYEQIABgUC
    QzbHCQAKCRAr41MrFHD9zSGSAKCkWXYchqRHacEeVGcmj60LzyC8gACeK7dfUezL
    2vtNUwHJtMq6DD+2/n0=
    =k6Gm
    —–END PGP PUBLIC KEY BLOCK—–

  17. Alex Günsche am 29. June 2007 um 22:06 #

    Hm, I don’t know … it does work on my site. If you go to my contact page, open the PubKey field, enter your key and click “Extract”, the key gets properly extracted. Maybe you could try with a RSA key?

  18. David am 28. October 2007 um 10:01 #

    I can get the plugin to encrypt fine with wordpress and WP-ContactForm, but when I press on the link that says “More about encrypting your message…” nothing happens. In fact the link text disappears instead of showing the additional information, key fingerprint, etc.

    Is this a problem with my template? I use a Sadish template, but I also couldn’t get it to work on the default classic and Kubric templates either.

  19. Patrik am 13. December 2007 um 12:30 #

    Hey you, I just need a help finding a such PHP script, that just could be set up separately, and seems like a stupid question but, where you receive the crypted message how will you decrypt it? using other tools?

  20. Alex Günsche am 13. December 2007 um 19:59 #

    Yes, you would use GnuPG to generate your key pair and to decrypt the messages on your machine. For decryption, you may want to integrate it with your mail client.

  21. David am 13. December 2007 um 21:38 #

    Alex,
    Any idea why my “More about encrypting your message” link doesn’t produce the additional information? I’ve tried several templates and nothing works. I haven’t altered the plugin code at all.

  22. Tiff am 30. July 2008 um 21:33 #

    Firstly, thanks for a great plugin, I got this working with CformsII and its great. Unfortunately, I’m having the same problem as David with the “More about encrypting your message” link doing nothing (tho it does disappear, so I guess that’s Something) when clicked. I only have that issue in Mozilla Firefox, it works perfectly in IE6 so I know its not a template issue but likely something browser related. Any ideas?

  23. Alex Günsche am 7. August 2008 um 23:35 #

    Sorry, I don’t know. It works for me in FF, though I use FF on Linux, don’t know about Windows. Does it work on my site in your FF?

  24. Christiaan am 16. December 2008 um 21:40 #

    Hi Alex, thanks for the plug-in. I’m about to have a go using it with cforms II.

    I noticed the link Kai Schott’s instructions is broken though. You might like to point it to here: http://blau.in/blog/720

  25. Christiaan am 18. December 2008 um 22:49 #

    I’d sure welcome any explicit instruction on doing this with cforms II. Given it a go but no luck.

  26. Christiaan am 18. December 2008 um 23:22 #

    By the way does this work with S/MIME or only PGP?

  27. paul am 6. February 2009 um 22:50 #

    any one have any pointers for configuring this for cformsII 10.2
    http://www.deliciousdays.com/cforms-plugin

    thank’s in advance

  28. REBELL Magdeburg am 2. February 2010 um 13:37 #

    Works very fine! And it’s for an beginner like me easy to install! Big respect and much thanks to the programmer! :D *thumbs up*

  29. lxg » Blog Archive » Encrypted contact forms for WordPress am 6. April 2011 um 21:13 #

    [...] can read more about the plugin on its description page, where you will also find the [...]

  30. Email cifrate con chiave GPG in WordPress « Che ne so? am 3. June 2012 um 09:58 #

    [...] questo punto ho trovato l’ottimo plugin per WordPress Subrosa, che consente la cifratura direttamente nel form di invio dell’email tramite javascript, [...]

Please support our OpenSource developments. Donate some bucks! Use the form in the upper right of this page, and get a backlink!

Artikel kommentieren

 (wird nicht veröffentlicht)


Kommentare können bis zu 30 Minuten nach dem Veröffentlichen bearbeitet werden.