<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-encryption
description: >-
  Implement email encryption using S/MIME, PGP/GPG, TLS enforcement (STARTTLS,
  MTA-STS, DANE), and message-level encryption for confidentiality and integrity.
domain: cybersecurity
subdomain: email-security
tags:
  - encryption
  - smime
  - pgp
  - tls
  - dane
  - mta-sts
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1114", "T1048.003"]
  tools: [openssl, gpg, swaks, certutil]
---

# Implementing Email Encryption

## Overview

Email encryption protects message confidentiality at transport (TLS/STARTTLS)
and message (S/MIME, PGP) layers. Transport encryption prevents eavesdropping
in transit while message encryption ensures only intended recipients read content.

## Prerequisites

- Tools: openssl, gpg, swaks, certutil
- Certificate authority access for S/MIME certificates
- Understanding of PKI and key management

## Key Concepts

- **STARTTLS**: Opportunistic TLS upgrade for SMTP connections
- **MTA-STS**: Enforced TLS policy via HTTPS-published policy
- **DANE**: DNS-based authentication for TLS certificates
- **S/MIME**: Certificate-based message signing and encryption
- **PGP**: Web-of-trust-based message encryption

## Workflow

### Step 1: TLS Enforcement

```bash
# Test SMTP STARTTLS support
openssl s_client -starttls smtp -connect mx.example.com:25 -brief

# Check TLS version and cipher
openssl s_client -starttls smtp -connect mx.example.com:25 \
  -tls1_2 -cipher 'HIGH:!aNULL:!MD5'

# Verify DANE TLSA record
dig TLSA _25._tcp.mx.example.com +short

# Check MTA-STS policy
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
```

### Step 2: S/MIME Certificate Management

```bash
# Generate S/MIME CSR
openssl req -new -newkey rsa:2048 -nodes \
  -keyout user.key -out user.csr \
  -subj "/CN=user@example.com/emailAddress=user@example.com"

# Self-sign for testing
openssl x509 -req -in user.csr -signkey user.key \
  -out user.crt -days 365

# Export PKCS#12
openssl pkcs12 -export -in user.crt -inkey user.key \
  -out user.p12 -name "user@example.com"

# Verify certificate
openssl x509 -in user.crt -noout -text | grep -A2 "Key Usage"
```

### Step 3: PGP Key Management

```bash
# Generate PGP key pair
gpg --full-generate-key --expert

# Export public key
gpg --armor --export user@example.com > user_public.asc

# Encrypt and sign message
gpg --sign --encrypt --recipient recipient@example.com --armor message.txt

# Verify signature
gpg --verify signed_message.asc
```

### Step 4: Verify End-to-End Encryption

```bash
# Send TLS-encrypted test
swaks --to recipient@example.com --from sender@example.com \
  --tls --tls-verify --server mx.example.com

# Verify TLS in received headers
grep "TLS" received_headers.txt
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| TLS downgrade | SMTP logs | Connections falling back to plaintext |
| Certificate expiry | Monitoring | S/MIME or TLS certs near expiry |
| Unencrypted PII | DLP logs | Sensitive content sent without encryption |

```yaml
title: SMTP TLS Downgrade to Plaintext
id: d4e5f6a7-b8c9-0123-def0-456789012345
status: experimental
description: Detects SMTP falling back to plaintext indicating TLS stripping
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    dst_port: 25
    tls: false
  condition: selection
falsepositives:
  - Legacy mail servers without STARTTLS support
level: medium
tags:
  - attack.t1557
  - attack.credential_access
```

## Verification

- [ ] STARTTLS supported and enforced on all MX endpoints
- [ ] S/MIME certificates deployed and validated
- [ ] PGP keys generated and distributed securely
- [ ] MTA-STS or DANE enforcing TLS for inbound mail
- [ ] Encryption policy covers sensitive data classifications

## References

- [NIST SP 800-177 Rev 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
- [MTA-STS RFC 8461](https://datatracker.ietf.org/doc/html/rfc8461)
- [DANE RFC 7672](https://datatracker.ietf.org/doc/html/rfc7672)
