What is the order of operations when both compression and encryption are enabled? Is compression applied to emails first and the resulting blob encrypted? Or is it the other way around and compression is applied to encrypted blobs?
From what I’ve read, the former is typically preferred from a compression standpoint as encrypted blobs have fewer compressible patterns. But I’m honestly just learning the interaction between the two so I could be wrong.
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
Encryption is applied first, and the resulting (encrypted) blob is what gets compressed before being written to the blob store.
Looking at the ingest pipeline in the source: when encryption-at-rest is enabled, the raw message is first run through PGP/S-MIME encryption (message.encrypt(...)), producing a new raw message. That already-encrypted raw message is then handed off to the blob-storage routine, which calls put_blob(...) using the configured email.compression algorithm (LZ4). So the compression step operates on the encrypted bytes, not the other way around.
This does mean compression gains will be minimal on truly encrypted content, since ciphertext has little exploitable redundancy, but that’s the actual behavior in the current codebase. The encryption-at-rest documentation covers the encryption side of this: Overview | Stalwart
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.