email encryption
email encryption
2026-07-19
Email, one of the most pervasive and enduring technologies of computer<br>networking, was invented in about a dozen places by dozens of people in the<br>1960s. It's hard to lay out a clear history of the technology because it's just<br>so obvious—pretty much as soon as more than one person could use a computer,<br>there was some kind of mail facility. These ranged from mainframe-centric<br>systems where all of the users of a single computer could write messages to each<br>other, to PC-centric systems where workstations would mount a network share to<br>store and retrieve messages. Pretty much any scheme you can come up with for<br>moving messages was probably in use somewhere from roughly the 1960s to the<br>1990s, by which time the ARPANET-derived family of email implementations had<br>taken hold.
This form of email has a clearer heritage, to Ray Tomlinson, who came up with<br>the core idea that addresses could identify both a user and a host, and that<br>some kind of open protocol could be used to send messages to another host when<br>necessary. Over time, and with many revisions, Tomlinson's design became SMTP<br>and was joined by protocols like IMAP that built out the form of email we use<br>today. This is a form of email that is in some ways decentralized (any user is<br>free to choose a host) and in other ways centralized (each host assumed to be<br>continuously online to store-and-forward messages for its users). Tomlinson's<br>design was flexible enough that we have not had to totally get rid of it, but<br>enough has changed about the modern Internet that we have had to take a new<br>approach.
Email has many vexing limitations, artifacts of its age. For example, email<br>handling should not be assumed to be "8-bit clean"—email protocols were<br>originally defined over 7-bit ASCII and ran on many machines that used the<br>eighth bit as a checksum. These machines were prone to changing the last bit of<br>each byte, or otherwise mishandling email with 8-bit content. That wasn't a<br>problem when text was completely limited to that 7-bit plane, but both Unicode<br>and the desire to send binary files made 7-bit email unworkable. MIME was<br>developed as a workaround, an encoding technique that solves a few problems in<br>one go by encoding all non-ASCII content of email in the form of ASCII<br>characters.
This is rather inelegant. MIME's ASCII encoding, whether quoted-printable style<br>or base64 style, is annoying for humans to read and inefficient with regard to<br>message size. As with all base64-like encodings, it counts as a suspicious<br>smell, an indication that we are papering over past mistakes. Email is full of<br>them. Let's consider another: security.
"Internet email," a term we can use to try to explicitly specify the SMTP-type<br>email system inherited from ARPANET, uses a simple design that dates to an era<br>when the operators of networked computers all knew each other. While there were<br>other possibilities, most email was delivered directly to the computer of the<br>recipient, and in a lot of cases the host-level security of the era wasn't very<br>good either. The possibility that someone else could read your private email was<br>known and there wasn't a whole lot you could do about it. The internet existed<br>within a context of trust.
We don't extend that same trust today. Email is usually handled by third-party<br>mail services on either end, which are not necessarily trustworthy, and to get<br>between the two third-party mail services it has to pass through a series of<br>internet links that are also of questionable security. Email became one of the first,<br>probably the first, compelling application of large-scale computer networking.<br>It may have also been the first of the field's enduring security failures. The<br>system was designed with no concern for message confidentiality or integrity,<br>and much of it still operates that way today.
Still, there's a long history of efforts to improve email security, and we<br>should probably start the story with the greatest of all: not just an email<br>protocol, but an entire stack of protocols that promised a better internet in<br>general: the OSI suite.
X.400
The modern internet was born of an era often called the "protocol wars." When we<br>tell the story of the internet today, we tend to simplify it to a nice linear<br>tale in which ARPANET was created, everyone thought it was a good idea, and it<br>proliferated. That's not totally wrong, but it leaves out a lot of the other<br>actors. The telecom industry famously had its objections to the packet-switched<br>model, which had originated from the computer industry rather than the<br>communications industry and showed it. During the 1970s and 1980s, the telecom<br>industry defined its own set of network protocols, and fundamental approach to<br>computer networking, which came to be known as the OSI protocol suite.
Today, the relevance of the OSI protocols is limited to the frustrating<br>insistence of modern networking textbooks on trying to explain the internet in<br>terms of the "OSI model," a now...