Subject: Survey about S/MIME or the use of encrypted eMails in general

From: "Juergen H" <[email-masked]>
Date: Sat, 29 May 2004 14:25:14 +0200

Hi Everybody!

I’m due to write a software and paper for/about secure eMails. Software will
use S/MIME, but for the paper other protocols like PGP etc. are also
interesting to me…

Does anybody know where to find some good surveys about the use of encrypted
eMails. I think that the amount of peoples who use S/MIME, PGP etc is very
small? (smaller than 5-10% ?!?!?!)

There are some good surveys about spam, viruses etc – but I didn’t  find
something interesting about encrypted eMails…

Thanks…

Jürgen

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 29 May 2004 16:32:35 +0200

Hi Juergen,

<snip>
>There are some good surveys about spam, viruses etc - 
>but I didn't  find something interesting about encrypted eMails.

Due to the absence of a working key-distribution system
encrypted mail is mainly a nice theory.  You will probably
get messages from people claiming that they are "encrypting
e-mails all the time" but they do not represent the bulk of the
Internet users.

Actually, there is a de-facto system for secured messaging
that has considerable advantages over S/MIME and that is to
use e-mail notifications containing https links to web-sites
where the user can (after authentication) access messages which
does not have to be encrypted as the communication between
the web-site and the user is protected by SSL.  This scheme
also allows a user signing off that he or she really has seen
(downloaded) a message.  This is the scheme e-governments
will most likely use for C2G messaging.

Another problem with message encryption on a wider scale
is that if you lose the encryption key you probably lose the
information as well.

Anders R

---

From: Ben Littauer <[email-masked]>
Date: Sat, 29 May 2004 16:49:37 -0400

Several analysts are willing to sell you surveys regarding the use of
encrypted e-mail.  Full disclosure: I'm a contributing consultant with one
of these firms, Ferris Research (www.ferris.com).

With regard to web-based secure e-mail (as sold by Tumbleweed, ZixCorp,
Sigaba, Authentica, and others), they are probably the most commonly used
solution, though they are not, strictly speaking "e-mail".  They are
excellent for a B2C environment, but have significant issues when deployed
in a B2B situation.

Another system that is gaining popularity is domain (border) encryption
using S/MIME gateways.  This is in use today by the FDA and Pharmas, as well
as in New Zealand's SEEMail system.  In addition, the Open Group and
Massachusetts Health Data Consortium (the latter of which I also consult
for), are developing a product certification program for these.  The primary
driver for this is to allow MA healthcare organizations to have
HIPAA-compliant e-mail with business partners.

Indeed systems that require broad deployment of PKI are considered
non-starters by most organizations I've worked with.

-ben-
Ben Littauer
1 Moon Hill Road
Lexington, MA 02421
781-862-8784
mobile: 781-223-0890
fax: 810-963-6163
[email-masked]
http://www.blkk.com

> From: "Anders Rundgren" <[email-masked]>
> Date: Sat, 29 May 2004 16:32:35 +0200
> To: "Juergen H" <[email-masked]>, <[email-masked]>
> Subject: Re: Survey about S/MIME or the use of encrypted eMails in general
> 
> 
> Hi Juergen,
> 
> <snip>

---

From: [email-masked] (Peter Gutmann)
Date: Sun, 30 May 2004 19:50:13 +1200

>small? (smaller than 5-10% ?!?!?!)

Far less than that, from (very informal) analysis of MTA logs carried out by a
few people a year or so back when comparing STARTTLS with conventional mail
encryption (S/MIME, PGP, etc), the latter is lost in the noise level (the
result of the survey was that a year after its introduction, STARTTLS was
protecting more mail than all other email security protocols combined).

Peter.