The Cryptographer | 2009 March 20

HTTP/S, Email Encryption and the Email Life Cycle

March 20th, 2009

8 comments

Misguided Impressions.
A majority of the people I talk to mistakenly think that email is safe. The slightly more tech savvy among us – people who read about things like email security in Wired or Cnet or Lifehacker, believe, incorrectly, that HTTP/S encryption will protect their email from eavesdroppers. Yet only the true security aware understand that it takes “end-to-end” and “data-at-rest” encryption to truly protect an email message across its entire life cycle. These individuals also understand that whole accounts are practically impossible to protect – so they concentrate on protecting the important messages.

While it is true that “data-in-motion” encryption like SSL and HTTP/S will protect emails from internet-café wireless eavesdroppers; we should be cognizant of the fact that that’s about all they protect us from. As the notorious Sarah Palin incident so poignantly illustrates, it doesn’t matter how you connect to your webmail, using just data-in-motion encryption is not enough.

So let’s get things straight. HTTP/S, SSL and TSL protect your messages as they travel from you to your email service provider or vice versa – usually the first fraction of a second in an email’s online life. During the rest of the email life cycle, HTTP/S encrypted emails exist in plain text. Only true end-to-end encryption, encryption like MailCloak, FireGPG, Enigmail and PGP provide, can protect an important email for it’s entire life cycle.

The Email Life Cycle:
Below as an outlined the life cycle of a typical email. As you’ll see, an email passes through a lot of hands (routers) between sender and recipient – and there’s no way to tell how clean these hands are. We will use the example of you, a gmail user, sending email to your friend Alice, a Yahoo! Mail user, to make things more concrete.

1. You write an email and click send.

2. The email travels from your computer over your LAN to your router, it then “hops” to your ISP, and then over the Internet to Google’s nearest gmail data center. The connection between your computer and Gmail may be encrypted with HTTP/S. If so, your message will be protected across these hops (I usually count 12-15 hops on a traceroute to gmail). If you didn’t use HTTP/S, each of these routers could (and many of them do) copy and index your message – you have no way to know.

3. The message arrives at Google, and is indexed and saved on redundantly backed up servers. You can now see your message in your “sent” mailbox.

4. Google now sends your message across the Internet to Yahoo’s datacenter. You can’t do a traceroute from Google to Yahoo, but you can assume that the route takes at least a few hops. At this point your message is traveling in plain text, so each router between Google and Yahoo can copy and index your message. And of these routers may be located in a government surveillance center.

5. Yahoo! receives and indexes your message, then transfers it to Alice’s inbox.

6. Alice now connects to Yahoo! and downloads the message. Again, the message hops over a dozen or more routers or computers before reaching Alice.

7. Alice reads the message.

8. The message and attachment resides indefinitely on Google’s and Yahoo’s servers. Anyone who logs into either your or Alice’s account can search the account, and if they search the right keywords, they will find your message.

Protecting an Email Message Throughout its Life Cycle.
It turns out that with minimal changes to this life cycle and the user experience, a message can be permanently protected from any and all eavesdroppers. All one has to do is encrypt (cloak/scramble) the message between steps one and two (after clicking send, but before the message goes out over the network), and decrypt the message between steps six and seven (after downloading, but before reading) and the message will always be safe, because it will never be exposed to the internet in plain text. This is called end-to-end encryption because your message is only in plain text at the endpoints. It’s also called data-at-rest encryption, because the email is only stored as an encrypted message.

MailCloak and Standards-Based Encryption
MailCloak, along with a host of other OpenPGP based programs, will all help you to encrypt your messages with end-to-end encryption. When we wrote MailCloak, we chose to use GnuPG OpenPGP encryption because all OpenPGP programs can talk to each other – and there’s an OpenPGP program for just about every computing platform out there. If you have Windows XP and you use Gmail, Hotmail or Yahoo! Mail, or a standard POP3 Email Client, you can use MailCloak – MailCloak will be available for Vista and Windows 7 soon. If you have Mac or Linux we recommend FireGPG for Gmail on Firefox, Enigmail from your POP Mail.