There are three major challenges in email encryption: certificate application, key management, certificate use. This article explains how ZTmail solves the key management problem and how to automate key management.
Key management refers to the management of the private key used for email encryption, and the public key has been managed by ZoTrus Public Key Exchange System. So, how should the private key, the core of email encryption, be managed? Key management includes the generation, use, storage, and updating of keys, and as long as the encrypted email has the value of retention, the private key must be kept at all times so that it can be used to decrypt the encrypted email. Therefore, ensuring key security is one of the core tasks of email encryption, and it is also the most important work in email encryption.
When the user applies for an email certificate from the CA, the local computer generates the private key and CSR, submits the CSR to the CA to apply for the email certificate, and after obtaining the public key certificate issued by the CA, it is manually or automatically synthesized into a certificate file (.pfx/.p12) containing the private key and the public key, and a protection password must be set for the certificate PFX file. The user needs to keep the certificate file and the certificate protection password and must enter the protection password every time the certificate is imported and used in various email clients, if user forget the protection password, it is equivalent to the email certificate is invalid, and all emails encrypted with this certificate can no longer be decrypted. This is the importance of key management, because the content of some emails is very important, but you can't decrypt it when you need it, and you will regret encrypting it in the first place.
In other words, traditional email encryption requires users to keep the certificate private key and protection password by themselves, and they need to back up the certificate on multiple devices at the same time, because if a computer system is broken, the key will be completely gone. Encrypted emails can no longer be decrypted. This is the difficulty and pain point of key management, and it must be solved to let users use email encryption services with confidence.
How to solve the key management problem? Users keep the key on their own computer, which is not only difficult to manage, but also in case the computer breaks, the key is gone. The only way out is to use cloud services, because we can assume that cloud services are always available. So, it is a good idea to keep keys in the cloud, and all well-known cloud service providers offer key management services for a fee.
However, ZTmail does not intend to provide cloud key management service, because the product concept advocated by ZoTrus Technology is the concept of zero trust, and the custody of users' keys is not only a great responsibility, but also may encounter a trust crisis of users, and users may not trust our key management services and abandon our services, which is a thankless solution. However, what if you don't want to manage your keys by yourself and need a key management solution to solve the key management challenges?
ZTmail has innovatively given a solution - the user's certificate file (.pfx) containing the private key and public key certificate will be automatically sent as an email attachment to the user's own mailbox for safekeeping, that is, the user can keep his own private key, and it will be kept in the cloud and will not be lost, unless the email service provider goes out of business, which is a high probability of impossibility. The reason why it is plaintext email is, of course, that when the user reinstalls ZTmail or installs ZTmail on a new device, it must be able to obtain the email in plaintext and automatically obtain the private key of the certificate, and reinstall the certificate for decrypting encrypted emails and sending encrypted emails.
Of course, to protect the security of the private key, the backup file stored in this plaintext email must be encrypted. It uses a 128-bit symmetric algorithm for encryption and provides the user with a 'recovery key,' which the user must keep safe. When ZTmail backs up the PFX certificate file to the user’s mailbox, it automatically creates a folder called 'ztmailbak' and stores the key backup emails in that folder. This allows ZTmail to quickly and automatically retrieve the user’s key for use on a new device, but the user needs to enter the 'recovery key.' Users must keep the 'recovery key' safe and cannot delete the 'ztmailbak' folder and the email inside it that used for backup If ZTmail App can’t find this folder or the backup file email, it won’t be able to automatically decrypt previously encrypted emails unless the user has already backed up the certificate file and can import it. If the manually import succeeds, ZTmail will still automatically back up the private key to the user’s mailbox again.
In line with the concept of zero trust security, if users do not want to continue to use the email encryption automation service provided by ZTmail, they can use the function of exporting all certificates (including private keys) with one click provided by ZTmail at any time, and after exporting the certificate, they can manually import the email certificate to other email clients that support S/MIME standard, and then decrypt all emails encrypted by ZTmail before, completely relieving the user's worry of being tied to ZTmail. This is also an advantage that other closed-private protocols for email encryption cannot match.
ZTmail's innovative key management solution not only realizes the automation of key management, but also solves the security concerns of the key managed by a third party, and it solves the problem that the key may be lost by the user's own management. Only by automating key management can we truly automate email encryption and popularize email encryption applications.
The reason why S/MIME email encryption technology cannot be popularized is because this technology is difficult to apply, mainly in two aspects: certificate application and key management, and the only way to solve these two problems is automation. ZTmail S/MIME certificate automation and key management automation completely solve these two problems, this is an innovative solution of client-cloud integration, the three are indispensable, and it is natural together, which is the great contribution made by ZoTrus Technology in email security for global email security, and will definitely be welcomed by global email users, and we will work together to create a secure email world with zero fraud, so that the ancient decentralized email service will continue to better benefit mankind more.