S/MIME and PGP: Email Encryption Compared

A normal email is like a postcard. In principle, anyone with access can read it on the way and on the servers. For contracts, payroll data or patient data, that is not good enough. Both methods solve the problem with asymmetric encryption: every person has a public key for encrypting and a private key for decrypting.

How encryption works

1. The sender obtains the recipient's public key.
2. They encrypt the message with it. From now on, only the matching private key can open it.
3. The recipient decrypts the message with their private key, which only they hold.

Signing works the other way round: the sender signs with their private key, and the recipient checks the signature with the sender's public key.

S/MIME: Certificates from a certificate authority

S/MIME (Secure/Multipurpose Internet Mail Extensions) relies on X.509 certificates. A certificate authority confirms that the email address, and depending on the level also the name or company, belongs to the key, and issues a certificate.

• Advantage: Built into Outlook, Apple Mail and many other clients. Trust is clearly defined, similar to certificates for websites.
• Disadvantage: Certificates cost money, expire and must be renewed. The recipient usually only gets the public key once the sender has sent them a signed message.

PGP: Keys in your own hands

PGP (Pretty Good Privacy), as the open standard OpenPGP, relies on keys that users create themselves. Whether a key is genuine is checked by the users themselves, through chains of trust or through directories.

• Advantage: Free, open and independent of certificate authorities. Thunderbird includes OpenPGP, and there are extensions for other clients.
• Disadvantage: Checking whether a key is genuine is up to the user. For a long time that was cumbersome.

The Web Key Directory (WKD) makes this easier. Through it, a company publishes its employees' PGP keys on its own domain. Mail clients and gateways then find the keys automatically.

The comparison at a glance

The two methods are not compatible with each other. If you communicate in encrypted form with many partners, you often need both in practice.

What S/MIME and PGP do not protect

• Metadata: Sender, recipient, time and usually the subject line stay readable.
• Hacked mailboxes: If an attacker has access to an unlocked mailbox, they read the messages just like the user.
• Phishing: An encrypted message can still contain a dangerous attachment. A virus scanner can only check it after decryption.

Transport encryption is no substitute

Many mail servers encrypt the connection between them with TLS. That protects the message on the way, but not on the servers, where it is stored in plain text. S/MIME and PGP protect the content itself. The two approaches complement each other.

Encryption at the desk or in the gateway?

Traditionally, every person encrypts in their own mail client. That is true end-to-end encryption, but it takes effort: everyone needs their own keys, must back them up and keep track of their partners' keys.

A gateway handles this centrally. It encrypts outbound mail before it leaves the company and decrypts inbound mail. Nobody has to do anything at their desk. Inside the gateway, the message is briefly in plain text so that it can be scanned and encrypted or decrypted. How it is then delivered internally depends on the gateway: some deliver it unencrypted, others encrypt it again for each recipient.

Email encryption in the SecTepe Mail Security Gateway

The SecTepe Mail Security Gateway encrypts and signs mail with PGP or S/MIME, set up for group mailboxes such as "hr@" or "contracts@". It decrypts inbound encrypted mail to a group mailbox with the group key and encrypts it again for each authorized member. It finds recipients' keys itself, among other places in the Web Key Directory of the recipient's domain. For recipients without a key, you choose per group mailbox what happens: reject, sign only, plain text with a warning, or delivery through a secure portal. By default, plain text with a warning applies.

Conclusion

S/MIME and PGP do the same job: they encrypt and sign email. S/MIME relies on certificate authorities and is common in business software. PGP is open and free, and the Web Key Directory makes it much easier to use. Which one you need depends on your partners. Often the answer is both, handled centrally in the gateway.