End-to-end email encryption. What is it and how does it work?

What is end-to-end email encryption?

End-to-end email encryption is a method of transmitting data where only the sender and receiver can read email messages. With end-to-end email encryption, the data is encrypted on the sender’s system. Only the intended recipient will be able to decrypt and read it. Nobody in between can read the message or tamper with it. End-to-end email encryption provides the highest level of confidentiality and protection to your email communication.

What is not end-to-end email encryption?

For a better understanding of what end-to-end email encryption is, we must first understand what is not end-to-end encryption.

• SSL/TLS – When you visit https://www.gmail.com, the HTTPS in front of the URL denotes that SSL/TLS protocol has been used to encrypt the data transferred between your computer and the Gmail servers. This protocol is much more secure than HTTP (without “S” = not secure). Most websites adopted SSL/TLS to protect against malicious intermediaries. The downside to relying solely on HTTPS, is that data is only encrypted between your device and the Gmail servers. Gmail has the keys to decrypt that data.
• SMTP over TLS (STARTTLS) – Lets take the case of a Yahoo mail user that sends an email to a Gmail users.  When you send an email with SMTP over TLS between these two mail services, the message between the two servers is encrypted on a condition that the recipient server also supports SMTP over TLS (which Gmail does). Using STARTTLS is a good practice, however several attempts are made to ‘portray’ this as the ultimate email security and privacy solution. In our opinion STARTTLS is not good enough since both the sending and receiving server have access to the message content. Moreover, not all receiving servers support STARTTLS.

Because of the imperfections of SSL/TLS and STARTTLS, end-to-end encryption remains the only secure way for your email communication.

How does end-to-end email encryption work?

End-to-end email encryption requires both sender and recipient to have a pair of cryptographic keys. There is one private key and one public key. The sender encrypts the message locally on his device using the recipient’s public key. The receiver decrypts it on his device using his private key. The process works as follows:

1. Alice (sender) and Bob (recipient) both generate their keypairs and share their public keys with each other. They keep their private key ‘private’ as the name suggests. You only need to generate your keys once when creating an encrypted email account.
2. Alice encrypts the message using Bob’s public key in her device and sends it to Bob.
3. Bob receives the encrypted message on his device and decrypts it using his private key.

With real end-to-end encryption, also called “client-side encryption” or “zero access”,  all encryption and decryption happen on the users’ devices. End-to-end encryption thus prevents any intermediary from reading user data and guarantees the confidentiality of the data much more than SSL/TLS or STARTTLS.

Advantages of End-to-End email Encryption

End-to-end email encryption has the following advantages:

• Privacy: The content of your emails and the attachments are protected from being read by anybody else than the intended recipients. It protects you among others from threats of hackers taking hold of the data transfer by eavesdropping on Wi-Fi/or other channels.
• More security and authenticity: End-to-end encryption can be combined with digital signing. A digitally signed and encrypted email proves that the sender is indeed the ‘true’ sender of the message. It also guarantees that message is not tempered with during transit. 
• Say NO to mass-surveillance : End-to-end encryption protects your messages against mass-surveillance. 

Why have I not used it before?

End-to-end email encryption has existed for decades. The low adoption has several explanations. First, it is not in the interest of mainstream providers to support end-to-end encryption as their business model depends on advertising and selling user data. Secondly, our governments want to be able to keep a check on our communications. Last but not the least, end-to-end encryption has traditionally been hard to implement and difficult to use and understand.

Try Appriver for email encryption.