1

I've read that Google, Microsoft, and Yahoo have banded together to introduce a new protocol for email encryption - SMTP Strict Transport Security. From my understanding of it, it seems that it's just a way to make TLS mandatory as opposed to opportunistic. Am I missing something? What exactly does the new protocol accomplish.

Secondly, does the new protocol supplant the need for a service likes Zix that provides end-to-end encryption?

2 Answers 2

1

SMTP is a hop-by-hop protocol where the mail is transferred from the client to the recipient by using at least one intermediary server. Even when SMTP is used with TLS the mail is available at all hops as plain text, i.e. no end-to-end encryption. SMTP Strict Transport Security does not change this: all it tries is to make sure that the transport of the mail between the hops is properly secured. But the mail is still available in plain on each hop and can be read and even modified by anyone having access to this hop (i.e. system administrators, and maybe hackers and government too).

Solutions like PGP or S/MIME instead offer end-to-end security. In this case the mail gets encrypted by the sender with the public key of the recipient, so that nobody except the owner of the secret private key (i.e. the recipient) can decrypt it. The mail then gets transferred by the usual SMTP protocol but nobody in between can decrypt the body of the mail (the header is not encrypted).

I cannot extract sufficient technical details about Zix from their home page but it looks like that they are basically using the same ideas as PGP and S/MIME, i.e. end-to-end encryption using a directory of the recipients public keys. On top of maintaining this directory they offer clients which use this directory, gateways for transparent encryption and decryption to connect the usual mail clients and special mailboxes to connect with recipients which are not in the directory.

1
  • Missing verb in "I cannot sufficient technical details"
    – Jesse K
    Commented Oct 7, 2016 at 15:13
0

The current latest draft is this: https://datatracker.ietf.org/doc/html/draft-ietf-uta-mta-sts-01

It is a way for a receiving mail server to tell a sending mail server that the connection must be encrypted.

It does not offer end-to-end encryption.

Suppose you have an account at Google and I have an account at Microsoft (hotmail, msn, live). This is a way for Microsoft's server to tell Google's server that Microsoft's server will only accept the mail over TLS. But both Google and Microsoft will see the plaintext of the mail you send me. They need to see the plaintext to do spam filtering and to create user profiles for targeted advertising.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .