Google Gmail

Initiation: The sender composes a new email and explicitly turns on Additional encryption.
Verification: The user is required to sign in to verify their account before the message is sent.
Encryption: Google generates a Data Encryption Key (DEK), which is used to encrypt the email body, inline images, and attachments.
Key Wrapping (KMS Interaction): Google sends the DEK to your organization's external Key Management System (KMS) or Key Access Control List Service (KACLS). The KMS uses its master key to wrap (re-encrypt) the DEK.
Transmission: The encrypted message, along with the wrapped DEK, is transmitted and stored on Google's servers.

Notification: The recipient receives the mail, which is marked with a blue shield icon and shows an "Encrypted message" notification.
Authentication: The receiver opens the email and must sign in to their identity provider to verify their account.
Key Unwrapping: The KMS verifies the user's access rights and uses the master key to unwrap (decrypt) the DEK.
Decryption: The client receives the unencrypted DEK and uses it to automatically decrypt the email content, which is then displayed in the Gmail browser window.

Last updated 5 months ago