In 2014, both government surveillance and email hacking seemed to be at the center of headline after headline, from Sony’s embarrassing hack, to the revelation that your email is being snooped on by the government. Understandably, email encryption soon became a hot topic, with many users desperate to protect the privacy of their inbox.
Although interest in encrypted email has surged, many users still have a lot of questions. How does encryption work? And how secure is it, really? In this post, we’ll break down email encryption in a way that you can understand — even if you don’t have an advanced degree in computer science.
How Encryption Works
As the Internet has evolved, encryption has become an increasingly larger part of its backbone. When you make a purchase from your favorite website, chances are your browser is using encryption to transmit that data, so that no one else can see your credit card information. Likewise, on most secure websites, your records are encrypted on their servers, so that even if they’re hacked, your data is safe. This is why when Target was hacked in 2013, they urged customers to change their credit card numbers, but insisted that they weren’t in any danger.
When you encrypt a file, you make it unreadable to anyone but specific individuals that you choose. When data is encrypted, it’s passed through a cipher, which is an algorithm (a sort of mathematical formula) that scrambles your data according to a key. After the file is encrypted, only those with the key can access it.
The beauty of encryption is that secrecy is provided by the key, not the cipher. This means that even if a hacker knows everything about the type of encryption you’re using, he still won’t be able to read your file. Without ownership of the key, your data is safe.
How Safe is Encryption?
As long as your key is safe, your information cannot be accessed. If that’s the case, then how safe is a key?
Most encryption is based around the Advanced Encryption Standard, or AES (popularly referred to as “military grade” encryption). AES can provide 128, 192, and 256-bit keys — the longer the bit length, the stronger the key. If you wanted to brute force (to randomly guess) a 128-bit key, it would take an absolutely mind bending amount of time. Why’s that the case? A 128-bit key has a potential 340,282,366,920,938,463,463,374,607,431,768,211,456 combinations. For those counting at home, that’s 340 trillion, trillion, trillion potential combinations.
There’s no computer in the world (no, not even Watson) that can perform that many computations in a reasonable amount of time.
An Introduction to Encrypted Email
A study conducted in 2014 found that, on average, we check our email at least 15 times a day. Considering how connected we are to our inbox, it’s safe to say that email is a central part of our Internet life. We receive email from our banks, our bosses, our schools and just about every other institution that has a sizeable impact on our lives. Since so much of our email tends to contain private information, it’s not surprising that many people use encrypted email.
Unlike the background encryption that most websites use, email encryption requires a conscious choice on behalf of the person sending (and receiving) email communication. Users have numerous options when it comes to encrypted email, all of which have their own advantages and disadvantages. While the basics of encryption are the same across all of them, the specifics depend on what flavor of encryption is being used.
Journey in the Life: PGP
PGP, or Pretty Good Privacy, is a program that allows you to use encrypted email, scrambling your messages before you send them. PGP works by using public key cryptography, which means that instead of having just one key, there’s a key pair, which includes a private key and a public key.
The public key is designed to be shared with as many people as you want. You must give the public key to anyone who wants to securely communicate with you. Likewise, you must also retrieve the public key of anyone who you want to send encrypted email to. This process is what’s known as a key exchange.
The beauty of PGP is simple: while anyone can have your public key, only the person with the private key can actually decrypt the messages. Since you’re the only one with that key, anyone can send you encrypted email, but only you can read it.
Since PGP provides encryption from the time you send an email until the time it is received, it provides what is known as client-side encryption. This means that when it is traveling between servers on the Internet, the message is always encrypted. At no point is your encrypted email ever sent as plaintext. This means that as long as your private key is secure, no one, not even your Internet Service Provider, can read it.
While PGP is very secure, it isn’t widely used by the public. This is mainly because of how difficult it is to get running, not to mention how frustrating key exchanges can be. Remember, in order for someone to send you an encrypted email, you have to give them your public key. This makes PGP clunky in real-world use, as it only is effective with people that already have a working relationship (and who are tech-savvy).
Journey in the Life: S/MIME
Just like PGP, S/MIME also uses public key cryptography. Unlike PGP, though, S/MIME does not require users to exchange keys themselves. Instead, S/MIME uses digital certificates, which are pieces of code that verify the identity of the sender (and the recipient). Digital certificates are not created by the user, rather, they are created and managed by a third party, known as a certificate authority (CA). In order to obtain a digital certificate, it’s necessary to contact a CA, who then can assign you one.
In most cases, a CA will verify the identity of the person applying for the digital certificate via an agreement with another institution, like a credit agency, or a bank. Once the CA has confirmed the identity of the person applying for the certificate, they grant that person a certificate for a certain period of time.
Of course, while having a CA handle your certificate might seem like a great way to avoid the hassles of key exchange, it simply replaces old hassles with new ones. For starters, while it is possible to get a free digital certificate, they can only be used for non-business use, and they only last a year. Making matters worse, once you have your digital certificate, there’s no guarantee your email client will support it (Gmail, Yahoo!, and Outlook.com all lack support for digital certificates).
Journey in the Life: Portals
Thanks to both HIPAA and HITECH, hospitals, doctors, insurance companies and other people who come into contact with protected health information (PHI) have an obligation to protect that data. This also means that they’re obligated to protect that information while it’s in transit, meaning that there’s a fairly big incentive there for them to embrace encryption.
Of course, doctors are busy people — they don’t have time to deal with difficult protocols, nor do they have the ability to send their administrators for network security training. The end result is that many offices adopt all-in-one portal systems that handle encrypted email for them.
While portals are often used via email, they aren’t technically a way to send encrypted email. Rather, portals usually send users links to a login system that redirects them to the message their doctor was trying to send them. While this does allow for encrypted communication, it isn’t the same level of security provided by PGP or S/MIME.
Unlike both of those methods, portals do not provide client-side encryption. This is because messages are not encrypted from the time they leave the doctor’s device to the time they reach your inbox. While they might be encrypted while they are being stored, there’s no promise that the data is being encrypted between servers, meaning it is technically possible to intercept a plaintext message.
Yet, it isn’t security that’s the biggest weakness of portals: it’s user-friendliness. While PGP and S/MIME are both a hassle, portal systems are universally loathed throughout healthcare for being difficult to use. While doctors have been encouraged through HITECH to allow patients to access their medical records easily, not many patients are eager to try and crawl to that information through a cobweb of poorly designed user interfaces.
Journey in the Life: Virtru
Virtru is a plugin that’s available for multiple browsers that encrypts your email through whatever email provider you’re already using. Virtru works by encrypting your message on your computer before it is sent over the Internet. Until it reaches its destination, it remains encrypted, meaning that just like PGP and S/MIME, it provides client-side encrypted email. Virtru also uses 256-bit AES encryption, meaning that the encryption provided by Virtru is just as strong (if not stronger) than any other email encryption solution.
Unlike PGP and S/MIME, however, Virtru handles your keys for you, meaning that there’s no need to perform a key exchange with everyone you wish to send encrypted email to. To send an encrypted email with Virtru, you simply enable Virtru and send your email like you normally would. That’s it. Nothing else changes, and the recipient doesn’t have to do anything more than download Virtru in order to read your email.
Virtru works with Gmail, and Outlook, which means there’s no need to switch providers, or to change email addresses just to send encrypted email. Virtru also works with Android and iOS, meaning that you don’t have to give up sending (or reading) encrypted email when you’re not at your desk.
Encrypted email doesn’t have to be complicated. Virtru isn’t just easy for you, it’s easy for everyone you send email to — meaning that, chances are, if you send an encrypted message, you’ll likely get one back.