Google Gmail

I. Sending an Encrypted Email

  • Initiation: The sender composes a new email and explicitly turns on Additional encryption.

  • Verification: The user is required to sign in to verify their account before the message is sent.

  • Encryption: Google generates a Data Encryption Key (DEK), which is used to encrypt the email body, inline images, and attachments.

  • Key Wrapping (KMS Interaction): Google sends the DEK to your organization's external Key Management System (KMS) or Key Access Control List Service (KACLS). The KMS uses its master key to wrap (re-encrypt) the DEK.

  • Transmission: The encrypted message, along with the wrapped DEK, is transmitted and stored on Google's servers.

II. Receiving an Encrypted Email

  • Notification: The recipient receives the mail, which is marked with a blue shield icon and shows an "Encrypted message" notification.

  • Authentication: The receiver opens the email and must sign in to their identity provider to verify their account.

  • Key Unwrapping: The KMS verifies the user's access rights and uses the master key to unwrap (decrypt) the DEK.

  • Decryption: The client receives the unencrypted DEK and uses it to automatically decrypt the email content, which is then displayed in the Gmail browser window.

III. Showcase

I. Maximize feature potential

  • To optimize the use of this features across browsers and mobile apps, please configure your settings as follows:

    • For mobile app:

      • Update the related apps to the latest version for the best experience (example: Gmail is 6.0.260406).

      • Chrome is the recommended default browser.

      • Android: If it does not work properly in the app, clear the cache and try again.

    • For desktop app browser: Chrome (or Chromium core browser) is the recommended default browser.

  • These features work reliably in web browsers. On the mobile app, availability depends on the app version and Google's support, so usage may vary by version and is not always consistent.

IV. Supported data types when using Google CSE for Wrap/Unwrap Gmail

Service
Apps
Data that's client-side encrypted
Data that's not client-side encrypted

Gmail

  • Web browser

  • Android mobile app

  • iOS mobile app

Note:

  • For mobile app: Chrome is the recommended default browser.

  • Email body, including inline images

  • Attached files

    Note: Attaching client-side encrypted Drive files isn't yet supported

Email header, including Subject:, timestamps, and recipients lists

PreviousGoogle MeetNextFor Workspace Admin

Last updated