Navigation and service

BSI - Federal Office for Information Security (Link to homepage)

BSI-Project "EasyGPG": Simplifying e-mail encryption

E-mail correspondence is one of the most important means of transmitting information in the economic, governmental and private spheres. Despite existing legislation, data security breaches continue to occur repeatedly. Although measures such as transport encryption increase the level of protection, uncontrolled data leaks can still occur from servers where data is stored in a poorly protected and unencrypted form. Nor do operators of e-mail servers deserve our complete trust.

In the case of e-mail correspondence, this problem can be effectively addressed with end-to-end encryption (E-2-E). However, the technical solutions that exist today for encrypting e-mails are rarely used in practice. The reason for this mainly lies in the fact that the current solutions are not user-friendly when it comes to installation, configuration and use. Consequently, it is only experts who are able to ensure an acceptable level of protection when exchanging data. Given the growing number of cases of data and identity misuse, this situation can only be regarded as critical. There is therefore an urgent need to provide an end-to-end encryption solution that is straightforward and user-friendly enough to be widely adopted.

The goal of the BSI project "EasyGPG" is to provide simple, user-friendly and effective e-mail encryption, in which crucial processes are automated and the user does not have to contend with the underlying technology. At the same time, despite the high degree of user-friendliness, there should be no compromise in terms of information security. The main points are:

  1. Private and public keys are generated automatically.
  2. Public keys are distributed automatically.
  3. Messages are encrypted and signed by default.
  4. Publication and provision of the software.

To achieve these goals, the Mail User Agents (MUAs) must be adapted accordingly and the protocols in use extended. In this context, it is essential that the MUAs maintain a high level of user-friendliness and a "transparent" integration of the cryptography backend.

Ein gespiegeltes Schlüsselpaar mit roten und grünen Leuchtpunkten
Source: © faithie / Fotolia.com

Web Key Directory (WKD) and Web Key Service (WKS)

As part of the "EasyGPG" project, appropriate extensions for e-mail providers were developed that allow them to offer their users a simplified implementation and application of end-to-end encryption:

  • An HTTPS directory called Web Key Service (WKS) from which public keys for e-mail encryption can be fetched.
  • An accompanying tool called WKD Protocol to automatically publish and update public keys in the Web Key Directory. With this, it is possible to reduce the administrative workload associated with the Web Key Directory. Instructions on how to set up a WKD protocol can be found on the Web Key page.

What is a Web Key Directory (WKD)?

With a "Web Key Directory", public keys can be easily obtained from a service provider's URL directory by making an HTTPS request. This greatly simplifies an important part of the e-mail encryption process, namely the exchange of keys. This means that users can activate the secure exchange of e-mails and files more easily and make use of it in their daily e-mail communication.

In contrast to the previously used public key servers, the integrated Web Key Directory only publishes authenticated e-mail addresses including the public key. Using the integrated WKD, the e-mail server of the particular provider becomes the authoritative and reliable reference point for the correct public key of the e-mail address in question. This is because a verification procedure, ideally via the actual e-mail user's explicit confirmation, firmly connects the public key and the e-mail address. This largely rules out the risk of any confusion.

How does the Web Key Directory (WKD) work?

The great advantage of the WKD directory is the automation of the processes for obtaining the correct public key of the associated e-mail address. For the system to work, WKD must be supported by both the user's e-mail program and the e-mail service provider. This allows the server and the e-mail program to automatically exchange and apply the public keys to encrypt the e-mails. For this to happen, the following steps run in the background of each e-mail program:

  1. The sender's e-mail program requests a specific URL in the domain of the recipient's e-mail service provider.


    For the e-mail address "joe.bloggs@easy-gpg.de,

    the corresponding URL could look like this:

    https://easy-gpg.de/.well-known/openpgpkey/hu/g8td9rsyatrazsoiho37j8n3g5ypp34h

     

  2. If the public key for the recipient's e-mail address is available there, it is downloaded via HTTPS and stored locally.
  3. The downloaded public key can now be used to encrypt e-mails to the recipient without the user having to take any further action.
  4. If another encrypted e-mail is sent to the same recipient, the public key can be used straight from the local storage and does not have to be downloaded again.

What does WKD entail for the e-mail users?

Provided that WKD is integrated in the e-mail programs of both the sender and recipient and is supported by the providers of both communication partners, it is easy to use once e-mail encryption has been activated. The user selects the recipient of the e-mail. Messages are then automatically encrypted by default as soon as the e-mail backend (GPG) finds the public keys of the communication partners in the local key store or in the web key directory.

To achieve a basic level of security, the user no longer needs to check the public key and no longer needs to manage the public key manually.

The following link provides a demo of this application with Gpg4win / GpgOL.

How is WKD installed by organisations?

To implement Web Key Directory in your own organisation, you can find more detailed information on the Wiki pages of gnupg.org: WKDHosting

The only requirement is access to the web server of your own domain.

Larger organisations are advised to use a complete Web Key Service (WKS), which facilitates the automated publishing of the Web Key Directory.

WKD technical details

You can find concepts and technical details under WKD Details.

Confidentiality and security considerations are presented as part of the AutomatedEncryption concept.

Where has WKD already been implemented?

The following online services and platforms have so far partly or fully integrated WKD into their offerings:

GNU Privacy Guard (GnuPG):

  • Searching for keys using WKD has been implemented in GnuPG since v2.1.12. Since v2.1.23, it has been enabled by default.
  • WKD protocol and client tools have been part of GnuPG since v2.1.14.

E-mail clients:

All e-mail clients that use the locate-keys option of GnuPG automatically perform WKD queries.

Well-known e-mail clients that support WKD are:

Well-known e-mail clients that support WKS are:

E-mail service providers:

Examples of e-mail providers offering WKD:

Companies:

Examples of companies that use WKD:

Additional information for users:

Similar topics

Back to Free software