Aster 암호화의 작동 방식

Learn where your encryption keys live, how each kind of mail is protected, and what Aster can and can’t see.

Encryption needs no setup. Your account creates its keys when you sign up, and the settings in this article only let you review those keys and choose how Aster handles mail to people outside Aster.

Your keys

When you create your account, your device generates an encryption key pair. Your private key never leaves your device in a readable form. Aster stores only an encrypted copy, which your password or one of your recovery codes unlocks.

Because the server never holds a readable key, Aster support can’t reset your password in a way that restores your mail, and they can’t open your mailbox for you. Your recovery codes are your way back in. To learn more, see Recover your account.

View and export your keys

1. Go to Settings > Security, and then select the Encryption tab.
2. In Encryption Keys, find your OpenPGP key and its Verification code, which is your key’s fingerprint.
3. Choose what you want to do:
   • To share your fingerprint with a contact, select the copy icon labeled Copy verification code.
   • To give your public key to someone who uses PGP, select Export Public Key, or select the copy icon labeled Copy public key.
   • To back up your private key, select Export Private Key, and then enter your password. If two-factor authentication is on, also enter a code from your authenticator app.

Mail between Aster accounts

Mail from one Aster account to another is encrypted end to end. It’s encrypted on the sender’s device with the recipient’s public key and decrypted on the recipient’s device. Nobody in between, including Aster, holds a key that opens it.

Mail to people outside Aster

Mail to an address outside Aster travels over TLS, the transport encryption that the rest of the internet uses. After delivery, the recipient’s provider stores it under its own rules.

To protect a message to someone outside Aster, use one of these options:

• PGP: If the recipient publishes a key that Aster can find, the lock icon next to the recipient reads Encryption available. Select that lock to encrypt the message end to end. Aster looks for keys through Web Key Directory (WKD), public keyservers, and Autocrypt.
• A password-protected message: If the recipient has no key, send a message that opens only with a password you share. To learn how, see Send an encrypted message to anyone.

Mail from people outside Aster

Mail from another email service reaches Aster over the standard mail network. Aster encrypts it as it arrives, before storing it, so from then on it’s protected in your mailbox like any other message.

Change encryption settings

1. Go to Settings > Security, and then select the Encryption tab.
2. In Encryption Behavior, turn on the settings you want:
   • Auto-discover recipient keys: Looks up recipients’ public keys through WKD and keyservers while you compose.
   • Encrypt by default: Encrypts messages whenever a key is available.
   • Hide subject on encrypted mail: Replaces the visible subject with three dots and carries the real subject inside the encrypted part.
   • Require encryption: Stops a message from sending when it can’t be encrypted end to end. Turn this on only if everyone you write to uses PGP.
   • Show encryption indicators: Shows lock icons on encrypted messages.
   • Publish keys to WKD: Makes your public key discoverable through Web Key Directory.

To publish your public key to a keyserver, find Keyserver URLs and select Publish Key. Most keyservers don’t let you fully remove a key after you publish it, so publish only if you want your key to stay public. Some keyservers, such as keys.openpgp.org, send a confirmation email before they list your address.

What Aster can see

Aster sees what any mail server needs to deliver mail: the sender and recipient addresses, the time, and the size. Aster can’t read the message bodies, attachments, folder names, contacts, or search terms stored in your account.

Limits

• Encryption can’t stop a recipient from copying or forwarding what they read.
• Mail sent with an SMTP token from Settings > Bridge is protected by TLS in transit, but it isn’t end-to-end encrypted.
• If you lose your password and every recovery code, nobody can decrypt the mail already in your account.

Troubleshooting

• A recipient’s lock icon doesn’t offer encryption: The recipient doesn’t publish a key that Aster can find. Send a password-protected message instead, or ask for their public key.
• A recipient’s lock icon reads Recipient’s key is outdated: Aster has an older copy of the recipient’s key. Ask the person for their current key, and confirm its fingerprint with them. To learn how, see Verify a contact.

Related articles

• Verify a contact
• Send an encrypted message to anyone
• Turn on two-factor authentication
• Recover your account