Select an encryption technology

Secure Email Gateway supports the following industry-standard encryption technologies.

	Encrypted (site to site)	Encrypted (site to recipient)	Encrypted (desktop to desktop)	Crypto strength	Key exchange or password	Do recipients need extra software?
Key (S/MIME Secure Multipurpose Internet Mail Extensions (S/MIME) is a specification for secure email messages that uses the X.509 format for digital certificates and uses various encryption algorithms such as 3DES., PGP)	Yes	Yes	Yes	High	Yes	Encrypted (site to site) - No Encrypted (site to recipient) - Recipients may need key and email client plugin
Password (Windows)	No	Yes	No	Medium	Yes	No
Password (AES)	No	Yes	No	High	Yes	Recipients need zip utility that supports AES-256 (WinZip 9.0 or later, 7-Zip, IZArc, P7ZIP)
TLS	Yes	No	No	Medium	No	No

Tell me about...

• Key (S/MIME or PGP) encryption

  How it works

  Key encryption utilizes a public key The key a sender gives to a recipient so that the recipient can verify the sender's signature and confirm that the message was not altered. Recipients also use the public key to encrypt email messages to the sender. and a private key The secret key kept on the sender's computer that the sender uses to digitally sign messages to recipients and to decrypt messages from recipients. Private keys should be password protected.. The system works by encrypting email messages using the public key The key a sender gives to a recipient so that the recipient can verify the sender's signature and confirm that the message was not altered. Recipients also use the public key to encrypt email messages to the sender.. The messages can then only be decrypted using the private key The secret key kept on the sender's computer that the sender uses to digitally sign messages to recipients and to decrypt messages from recipients. Private keys should be password protected..

  Help me make a quick choice

  S/MIME encryption is superior to PGP encryption for a number of reasons.

  Advantages

  From an administrative and security perspective, S/MIME encryption is particularly good because of its strength, support for centralized key management via X.509 certificate A digital means of proving your identity. When you send a digitally-signed message, you are sending your certificate and public key. Certificates are issued by a certification authority and can expire or be revoked. servers, and widespread industry support.

  From an end-user perspective, S/MIME technology is preferable because it allows most standard email clients to send and receive encrypted email without the need for additional software.

  Disadvantages

  From an end-user perspective, PGP is more complicated, requiring additional plug-ins or downloads.

  PGP encryption is unavailable in FIPS Mode.

  PGP is recommended for encryption. S/MIME is recommended for signing over encryption. You cannot encrypt with S/MIME and sign with PGP or vice versa.

• Password encryption

  How it works

  Password encryption creates a password-protected zip archive of the email message.

  An 8-36 character password is automatically generated at the time of encryption. The auto-generated password is returned back to the email sender for manual distribution.

  If you want added security, you can instead define a passphrase of up to 128 characters.

  Some zip utilities may not support a password of this length, so you will need to make sure that recipients have a suitable zip package if you choose this option.

  Help me make a quick choice

  Password encryption is a good choice if your users need to send email messages to a partner with no PGP or S/MIME capability.

  Advantages

  • There is no complex setup or administration required. As long as you create an endpoint with the right addresses, password encryption works "out of the box".
  • Encrypted email can be sent to partners with no PGP or S/MIME capability.

  Disadvantages

  • It is a weaker security technology than S/MIME and PGP.

    Stronger password security can be achieved using AES, but it requires recipients to have a zip package that supports AES-256.

  • It relies on the password being sent separately by the user to the recipient. However, password-encrypted emails contain a notification for the recipient that they will need the password from the sender to decrypt the message.
  • Password encryption is unavailable in FIPS Mode.
• Transport Layer Security (TLS) encryption

  How it works

  Transport Layer Security (TLS) A cryptographic protocol that provides communication security over the Internet. The successor to Secure Sockets Layer. provides a secure, encrypted communications tunnel between two TLS-enabled email servers. Email passes through the TLS communications tunnel without itself being encrypted.

  If you want, you can use both TLS and key or password encryption, but there is more setup and administration involved.

  Help me make a quick choice

  TLS is a good choice for two organizations that communicate frequently and wish to exchange confidential data as long as the following statements are true:

  • The other organization is able and willing to set up TLS on their Gateway.
  • Both Gateways communicate directly.

  Advantages

  • Each email server authenticates to the other, making it harder to send spoofed email.
  • The traffic between the two servers is encrypted, protecting the email content from prying eyes while in transit.
  • The encryption of the conversation between the two hosts makes it exceedingly difficult for an attacker to tamper with the email's contents.

  Disadvantages

  • TLS protects the connection from your Gateway to the first destination Gateway. If there are intermediate hops when email is forwarded from one Gateway to another, the protection afforded by TLS is lost after the first hop.
  • If your Gateway is configured to use mandatory TLS, but the recipient's is not, no email will be exchanged.