How to Send Encrypted or Secure Email on Linux: A Comprehensive Guide

Email encryption is a great way to enhance your organization’s communication security by protecting your email content and ensuring unauthorized individuals can’t read the information.

Research shows that 94% of organizations have experienced phishing attacks. However, only some take these risks seriously until an incident happens with them. In the words of Edward Snowden, “Arguing that you don’t care about the right to privacy because you have nothing to hide is no different from saying you don’t care about free speech because you have nothing to say.” 

With increasing data security and privacy risks, organizations must implement advanced security measures like encrypted emails. This article will explore encrypted emails, their importance, and how to send them. 

Understanding Encrypted vs. Secure Email

Encrypted emails are different from secure emails. Understanding their differences is vital if you want to implement email security. It will help you choose a suitable security mechanism based on your communication needs and your required confidentiality level.

What’s an Encrypted Email?

An encrypted email is an email whose message content is encoded and transformed into an unreadable, secure format called ciphertext through an encryption technique. This ensures only those senders and receivers with appropriate keys or access permissions view and access the content. 

Encoding an email’s content is called email encryption, which helps protect sensitive data from harmful exposure or cyberattacks. Tools like GnuPG, S/MIME, etc., are used for end-to-end email encryption. In end-to-end encryption, emails are encrypted at the sender’s end and are meant only for the intended receiver to decrypt them on their system and view the content. 

The recipient and the sender must typically have an encryption code or key to access the email. This process happens automatically if both sides leverage an email client supporting encryption. An encrypted email typically has these features:

• Cryptographic keys - one public (that the sender uses for encryption) and one private (that the recipient uses for email decryption)
• Transport Layer Security (TLS) to protect data transmission between servers
• Secure/multipurpose Internet mail extensions (S/MIME) for email encryption
• Digital signatures for email verification 

What Is a Secure Email?

A secure email has protective measures implemented for its safe transmission over networks. It employs security protocols like Transport Layer Security (TLS) or Secure Sockets Layer (SSL) to secure the connection between the user’s web browser and web server. This protects data from malicious intent and ensures an email’s integrity, authenticity, and confidentiality. 

“Secure email” is an umbrella term that includes securing emails through various protection mechanisms rather than the content itself. A secure email doesn’t necessarily use end-to-end encryption but also many other security mechanisms, such as:

• Multi-factor authentication (MFA) to add another security layer through OTPs, facial recognition, fingerprint scans, etc. 
• Strong, lengthy, and unguessable passwords make it challenging for hackers to access accounts
• Personalized security questions (or choosing one from the given list and using a wrong answer) to prevent account hacks
• Digital signatures to validate email integrity 
• Access controls so that only authorized people have the email’s access
• Malware protection to scan links and attachments for threats
• Anti-phishing tools to prevent phishing attacks 

In addition, email security involves making users aware of cybersecurity risks, recognizing attacks, maintaining secure communications, and meeting compliance requirements. 

Differences Between an Encrypted and Secure Email

What Is the Importance of Encrypted Email and Secure Email in Data Protection?

Both encrypted email and secure email are essential. The main focus is data security and these two are just two ways to achieve it and avoid data exposure, phishing threats, and other cyberattacks. 

Importance of Encrypted Email

In encrypted emails, the content is first scrambled or encrypted with the help of an encryption key to make the email unreadable without the decryption key. Unlike a secure email, an encrypted one is not sent in plain text. It then gets transmitted over the network to reach the intended recipient. 

Thus, your email message is safe even if the email connection security breaks at any point in the network. Even if someone successfully accesses the mail server or intercepts the network, they can’t read the email message, thanks to end-to-end encryption. 

Encrypted emails are helpful for these scenarios:

• Individuals who want to protect their personal or professional communication from hackers and identity thieves
• Organizations that host email services on their own must use email encryption
• Enterprises that send or receive sensitive information must use encryption email since cyberattack risks are higher for them
• Organizations that operate under heavily regulated industries, such as finance, health, military, etc., need strong email encryption
• Companies that must meet solid regulatory compliance requirements need email encryption to secure their communications 
• Email service providers to protect their client’s information 

Importance of Secure Emails 

Sending secure emails is vital to protect your data privacy and security. They are helpful for the following scenarios:

• Protecting your personal or professional data against government-led surveillance, which is common in many countries from the US and UK to Germany, China, and Australia
• Safeguarding data from cybercriminals that may steal your identity, or money, or compromise your social accounts
• Securing your personal or business data from anti-parties and competitors who may misuse your data or discover your business secrets and strategies
• Preventing email service providers from monitoring your emails, sharing your information with advertisers, or selling your data to third parties.

What Are the Benefits and Drawbacks of Sending Encrypted Email?

Knowing the potential benefits and drawbacks of sending encrypted emails will help you make informed decisions when implementing email encryption in your communication network. 

Benefits

Enhanced Security 

Research reveals that 95% of business leaders are stressed about email security. 

Hackers who can access your email content may expose confidential data and trade secrets to competitors or sell customer data on the dark web. They can also use the data to carry full-blown attacks, such as phishing attacks, identity theft, etc., devastating a company based on reputation, money, and customer trust. 

Encrypted emails protect against email interception, ensuring only the designated receiver and sender read the email content. Even if someone can access your account, they can’t read the data without the decryption key.

Data Privacy

Security researchers have found that only 14% of email users encrypt their email communication, and 33% of users update their email passwords after a specific interval of time. 

Data privacy is instrumental for every individual or business. You don’t want your personal data, like social security numbers, health information, credit card details, personal photos, etc., to go public. Similarly, no company would want their internal matters exposed, which may harm their business.  

If you implement email encryption, you essentially keep your email content private from unauthorized people. 

Compliance with Regulations

Businesses, especially from highly regulated industries, must adhere to regulatory requirements applicable in their areas, such as GDPR, HIPAA, PCI DSS, etc. These regulations ensure that businesses use customer data responsibly and adequately. 

Sending encrypted emails allows you to support the cause and stay compliant with these regulations. It also avoids the risk of penalties and upholds customers’ trust in your business. 

Identify Genuine Emails from Spam

In 2022, 162 billion spam emails were sent to people every day in the same year.

Encrypted emails help you identify genuine emails from spam or phishing emails. You can use an email encryption service with a digital signing feature to ensure an email has an authentic sender. This way, you can reduce malware and security risks. 

Drawbacks of Sending Encrypted Email

Setup and Usage Complexity

Implementing email encryption in your communication can be a time-consuming and complex process. Organizations generally use end-to-end encryption, S/MIME, or PGP for configuration, which are difficult for anyone and might introduce specific vulnerabilities. 

Compatibility Issues 

Encrypted emails require recipients to use a compatible decryption method to read the email content. The sender and receiver can have different or incompatible email clients or systems, hindering decryption. 

Possible Inconvenience for Recipients 

Many recipients, especially non-tech staff, may find accessing emails inconvenient as they require decryption keys. If a recipient has lost the keys, they can’t read the email. If the email content is crucial or time-sensitive, desired actions can’t be taken on time. 

Key Management Challenges 

Managing encryption keys can be challenging for many users. If they don’t know the implications and store them on public servers, hackers may access them and harm the organization. It happened in the real world when sensitive US military information was spilled online due to human error. 

Thus, users must be made aware of what email encryption is and how it works through proper training. 

Open Source Tools for Email Encryption

Linux and information security (infosec) professionals prefer using open-source tools because their source code is publicly available and can be modified according to individual needs. 

So, if you want to implement email encryption in your communications, let’s explore some of the best open-source email encryption tools for Linux.

GnuPG (GPG)

GnuPG (GPG) is an open-source, accessible, and user-friendly command-line tool for Linux systems that helps implement end-to-end email encryption. This universally accepted tool lets you encrypt data and works across various email clients, including Apple Mail, Microsoft Outlook, and Thunderbird. Major GNU/Linux Oses have this tool installed by default. 

GPG fully implements the OpenPGP standard defined by PGP or RFC4880. This free software was introduced in 1997 and has a GNU General Public license. It allows anyone to freely use, distribute, and modify it under the GNU terms. GnuPG’s latest version is 2.4.5. 

GPG’s key management system is versatile and has an access module with several public key directories. It’s feature-rich, boasting many front-end libraries and applications, a graphical user interface, front-end scripting tools, and more. GPG also supports Secure Shell (SSH) and S/MIME and easily integrates with various applications. 

How GPG implements end-to-end email encryption

GPG utilizes public key encryption to safeguard emails. It combines symmetric cryptology (Secret Key) and asymmetric cryptography (Public Key + Private Key) to ensure high protection. 

To encrypt email content, you can utilize someone’s public key so that only the person with the corresponding private key can decrypt the email content. Here’s how to use GPG for email encryption. It also leverages embedded digital signatures to address the risks related to non-repudiation and data authentication. 

• Download and install GPG on your Linux system 
• Generate a public-private key pair 
• Share the public key securely with the intended receiver 
• Obtain the public key from the receiver 
• Import into GPG the receiver’s public key 
• Compose an email 
• In the email client you use, choose the “Encrypt” button. GPG will encrypt the email message automatically.
• Send your email. 

GPG Benefits

• Highly secure with asymmetric cryptographic and symmetric cryptology
• Customizable to meet your needs and works with various email clients 
• Easy to use and learn and widely supported 
• Integrates with multiple applications and tools
• Reliability and performance 

Drawbacks

• Can be complex to set up
• Requires a public key exchange

Use Cases

GPG is preferred by organizations that are heavily regulated and require high security, such as financial institutions, healthcare organizations, banks, government bodies, activists, and individuals to protect sensitive information. 

S/MIME

Secure/Multipurpose Internet Mail Extensions (S/MIME) is a public key encryption standard. It’s compatible with major enterprise-level email clients like Outlook, Gmail, etc. S/MIME offers two services:

• Email encryption to protect email content
• Digital signatures to verify the sender's identity 

How Does S/MIME Work?

S/MIME leverages asymmetric encryption using a pair of Public and Private keys. These key pairs are different but mathematically related and are used for encryption and decryption. 

Install a S/MIME certificate on both email clients to enable email encryption on both the sender and receiver sides. When the sender sends an email, they ask the recipient for their public key and encrypt it using this public key. When the email reaches the recipient, they decrypt it with their private key. 

To ensure only an authorized sender can send an email, S/MIME affixes a digital signature to it. Thus, obtain the recipient's digital signature if you want to send an email with S/MIME encryption. In addition, you’ll need S/MIME certificates. Certified authorities and third-party authorities provide these S/MIME certificates.

S/MIME Benefits 

• Native support for email clients like Outlook, Gmail, etc.
• High-security with encryption keys
• Email content confidentiality and integrity 
• Secure digital signatures for sender authentication 
• Safety net in legal proceedings as S/MIME voluntarily offers signature non-repudiation by the sender

Drawbacks

•  Dependency on certificate authorities
• Cost of obtaining certificates

Use Cases

S/MIME is preferred mainly in the corporate environments. Businesses need it for identity verification and to prevent unauthorized access. 

Other Tools

Other tools for email encryption include:

Mailvelope 

Mailvelope is an open-source add-on for Chrome, Firefox, and Edge web browsers. It allows you to encrypt emails via PGP using a webmail provider. This browser extension provides end-to-end email encryption without changing your current email provider. In this tool, encryption and decryption works on endpoints, keeping data private and secure. 

Enigmail

Enigmail is a free, open-source security extension for Postbox, Epyrus, and SeaMonkey. It lets you utilize OpenPGP to digitally sign and encrypt your email through a simple, intuitive user interface. It also allows you to decrypt emails and verify them. You can use, distribute, and modify the tool under the Mozilla Public License terms. 

Digital Certificates and Encryption

Digital certificates ensure sender authentication, which is why it’s crucial to obtain them. As discussed earlier, you can get them from a certified authority of a third-party provider.  

Let’s now understand how to obtain and manage digital certificates using providers like Let's Encrypt and OpenSSL.

Let's Encrypt

Let's Encrypt is an open and automated Certificate Authority (CA) that offers free SSL/TLS certificates to enable secure email transmission. Provided by the Internet Security Research Group (ISRG), Let's Encrypt certificates help protect email servers. 

How Let’s Encrypt Works

The ACME protocol and Let’s Encrypt allow you to configure an HTTPS server and obtain a digital certificate automatically. Let’s Encrypt checks that the person who controls that domain makes the certification request. To verify this, it sends a unique token only to retrieve a key from the token later by creating a DNS or web request. If the CA verifies the client, the client can request, revoke, or renew certificates for the domain. 

Let's Encrypt Advantages 

• Cost-effectiveness as it offers digital certificates for free
• Ease of certificate management and renewal
• Promotes widespread encryption adoption, making the internet safer for all
• Automatic digital certificate generation, configuration, and usage 
• Offers transparency as certificates are recorded publicly, allowing anyone to inspect them

Limitations 

• Let’s Encrypt offers domain-validated certificates, meaning validating only ownership, not the entity 
• 90-day expiration, but are renewed automatically 
• 5 duplicate certificates per week
• Lacks dedicated support

Use Cases

Let’s Encrypt is ideal for server authentication but not directly applicable to personal email encryption. This service helps individuals and organizations who want to enable HTTPS on their websites. 

OpenSSL

OpenSSL is an open-source, powerful, and fully-featured toolkit for enabling SSL/TLS encryption. It helps you perform general-purpose cryptography to protect your communications. 

The software is developed and maintained by the OpenSSL Project. It has an Apache-style license, meaning you can use it for free for your commercial and non-commercial needs under the license terms. Its core library is coded in C and offers multiple utility functions. It also has wrappers for using the OpenSSL library in different computer languages. 

OpenSSL is used by many web servers and major HTTPS sites and helps secure your emails. This security toolkit has three major components: 

• The libcrypto library comes with many APIs for cryptography
• The libssl library comes with functions to enable peer-to-peer communication security
• The command-line utility performs cryptographic tasks like encrypting or decrypting files, generating certificates, etc. 

How to use OpenSSL to create self-signed certificates

• Generate a private key for encryption using OpenSSL by entering the following command:

openssl  genrsa  -out  yourdomain.key  2048

• Create your Certificate Signing Request (CSR) using the private key generated above. Here’s the command to do that:

openssl  req  -new  -key  yourdomain.key  -out  yourdomain.csr

After this, you’ll be asked to fill in some information. Enter that. 

• Create your self-signed certificate that uses its own private key:

openssl  x509  -req -days  3650  -in your domain.csr  -signkey  yourdomain.key  -out  yourdomain.crt

Advantages of OpenSSL

• Feature-rich tool
• Flexibility as you’ll retain complete control over the certificate attributes and parameters
• Wide usage and strong community support
• Cost-friendly as it’s free and open-source
• Platform independent - Linux, Windows, and macOS

Limitations and Considerations

• Trust issues, as self-signed certificates, are not verified by an external CA
• Complexity, as it requires technical knowledge to generate and manage certificates.

Use Cases

OpenSSL is used by organizations across the world, from startups to enterprises. Some significant users include Infosys, Panasonic Corp, Fujitsu Ltd, and more.  

Challenges and Solutions When Sending Encrypted Email

Key Management and Exchange

Managing and distributing public and private encryption keys while sending encrypted emails and keeping them secure from attackers is challenging. 

Solution: To overcome this challenge:

• Store encryption keys on a secure public cloud server like AWS, GCP, etc. It’s cheaper, convenient, and user-friendly, but it might pose compliance issues in specific legislation. 
• Store keys on a private cloud or on-premises server in the same country for better data security and compliance with applicable laws. This could be expensive, though. 
• Exchange encryption keys manually without relying on a third party. 

User Education and Adoption

Using email encryption is generally difficult to use, impacting the adoption rate. 

Solution: To overcome this challenge, address the learning curve. Invest in training your employees on using email encryption and best practices. 

For example, they must know how to encrypt and decrypt emails to read email content, store keys on a private server, and more. 

Instead of troubling users with extra account creations, logins, or questions, prioritize user experience. Simplify email encryption by: 

• Leveraging user-friendly resources and tools, like ProtonMail or Hushmail, to ease the adoption process. 
• Adjusting protocols based on different environments 
• Enabling decryption via a web browser and verifying emails to authenticate identity 
• Implementing data access permissions and controls to encrypted emails for information security 

Practical Tips for Email Encryption

Best Practices for Email Encryption 

• Encrypt your emails, all of them, for greater data security and privacy 
• Choose a suitable email encryption system and method based on your organization’s needs.
• Authenticate encryption indicators while transmitting emails
• Backup your encryption keys and certificates
• Be cautious about key management and storage. Store only on secured, private servers or on-premises. 
• Educate users on email encryption and instruct them to follow best practices.

What to do if a key compromise is suspected?

In case your private key is compromised or stolen: 

• Immediately change your email passwords and modify security settings. Change the passwords of your crypto wallets or accounts
• Quickly move your assets or data to another, secure wallet
• Notify your wallet provider or crypto exchange 
• Report the incident to regulatory bodies in your region

Backup and Recovery of Encryption Keys and Certificates

Consider backing up your encryption keys and certificates in a secure, private server, on-premises system, or an off-site location. If you have the backup encryption certificate, you can restore your backups. Unfortunately, if you don’t, it’s not possible.

Our Final Thoughts on the Importance of Sending Secure or Encrypted Email on Linux

Encrypted and secure emails are essential to protect your email and the content from unauthorized access. So, implement email encryption and secure email practices to secure your organization’s communications, keep data private, and prevent cyberattacks. With the practical advice offered in this article, you should be well on your way to improving your email security and securing your critical data against leaks and breaches.