Google Takes Gmail Security to the Next Level with Client-Side Encryption

Dec 18, 2022Ravie Lakshmanan

Google on Friday announced that its client-side encryption for
Gmail is in beta to its Workspace and education customers to secure
emails sent using the web version of the platform.

This development comes at a time when concerns about online
privacy and data security are at an all-time high, and it is
certainly welcomed by users who value the protection of their
personal data.

To that end, Google Workspace Enterprise Plus, Education Plus,
and Education Standard customers can apply to sign up for the beta
until January 20, 2023. It’s not available to personal Google
Accounts.

“Using client-side encryption in Gmail ensures sensitive data in
the email body and attachments are indecipherable to Google
servers,” the company said^[1]
in a post. “Customers retain control over encryption keys and the
identity service to access those keys.”

It is important to know that the new protection offered by Gmail
is different from end-to-end encryption.

Client-side encryption, as the name implies, is a way to protect
data at rest. It allows
organizations^[2]
to encrypt data on Google services with their own cryptographic
keys. The data is decrypted on the client-side using keys that are
generated and managed by a key management service, which is hosted
in the cloud.

Google’s new feature requires administrators to set up an
encryption key service^[3]
through one of the company’s partner services which are offered by
Flowcrypt, Fortanix, Futurex, Stormshield, Thales, or Virtru, or
alternatively, build their own service using its client-side
encryption^[4] API.

This means the data is protected from unauthorized access, even
from the server or the service provider. However, the organization
or administrator has control over the keys and can monitor users’
encrypted files^[5]
or revoke a user’s access to the keys, even if it was generated by
the user themselves.

On the other hand, end-to-end encryption (E2EE^[6]) is a method of
communication in which information is encrypted on the sender’s
device and can be decrypted only on the recipient’s device with a
key known only to the sender and the recipient.

With that said, the new option – limited to the web browser for
now – permits users to send and receive encrypted emails both
within and outside of their domains. The encryption covers email
body and attachments, including inline images, but not the subject
and recipient lists.

Gmail is not the only Google product with client-side encryption
turned on. The tech giant enabled the same functionality for
Google Drive^[7]
last year and Google Meet^[8]
earlier this August. A similar test for Google Calendar^[9]
ended on November 11, 2022.

It’s worth noting that Google Drive apps for desktop as well as
Android and iOS support client-side encryption. Google said that
the feature will be integrated into mobile apps for Meet and
Calendar in an upcoming release.

“Client-side encryption helps strengthen the confidentiality of
your data while helping to address a broad range of data
sovereignty and compliance needs,” the company further added.