Google Gmail

I. Sending an Encrypted Email

• Initiation: The sender composes a new email and explicitly turns on Additional encryption.

• Verification: The user is required to sign in to verify their account before the message is sent.

• Encryption: Google generates a Data Encryption Key (DEK), which is used to encrypt the email body, inline images, and attachments.

• Key Wrapping (KMS Interaction): Google sends the DEK to your organization's external Key Management System (KMS) or Key Access Control List Service (KACLS). The KMS uses its master key to wrap (re-encrypt) the DEK.

• Transmission: The encrypted message, along with the wrapped DEK, is transmitted and stored on Google's servers.

II. Receiving an Encrypted Email

• Notification: The recipient receives the mail, which is marked with a blue shield icon and shows an "Encrypted message" notification.

• Authentication: The receiver opens the email and must sign in to their identity provider to verify their account.

• Key Unwrapping: The KMS verifies the user's access rights and uses the master key to unwrap (decrypt) the DEK.

• Decryption: The client receives the unencrypted DEK and uses it to automatically decrypt the email content, which is then displayed in the Gmail browser window.

III. Showcase