Security

PGP and S/MIME have critical vulnerabilities. What about Egress?

by Egress
Published on 18th May 2018

Many Egress users may have heard recently about the security flaws discovered in PGP and S/MIME. The vulnerabilities can mean that messages encrypted using these methods are vulnerable to attacks that can display the message in plaintext. More information on the flaws can be read on the researchers' website. 

Despite worries about the security of all encrypted email tools, the Egress platform is not affected by these vulnerabilities. Egress secure emails and files are secured with AES256-bit message encryption at rest and in transit (with the option to use TLS on selective email traffic); they do not use PGP or S/MIME for encryption. 

The vulnerabilities in PGP and S/MIME email clients are based on message integrity protection being optional, and also a particular way of integration with email clients, where a message may display both plain text and decrypted content at the same time without indicating it to the user.

How is Egress different?

  • The Egress platform has built-in integrity protection. Should a message be tampered with in transit, including tampering with AES CBC, it will be detected automatically and an error will occur. No part of the message text will be displayed to user in this case.
  • Egress does not combine decrypted and plain text parts of the same email on screen.
  • A decrypted HTML message is considered hostile, and no links inside the message are automatically followed, including links to images. Any images inside an Egress secure email must be included in the .switch file.

Egress have long highlighted concerns with implementations of legacy secure email solutions. These critical flaws further demonstrate the importance of future-proofed, end-to-end data security.

System.InvalidOperationException: The partial view '/app_plugins/doctypegrideditor/views/doctypegrideditor.cshtml' was not found or no view engine supports the searched locations. The following locations were searched:
/app_plugins/doctypegrideditor/views/doctypegrideditor.cshtml
   at System.Web.Mvc.HtmlHelper.FindPartialView(ViewContext viewContext, String partialViewName, ViewEngineCollection viewEngineCollection)
   at System.Web.Mvc.HtmlHelper.RenderPartialInternal(String partialViewName, ViewDataDictionary viewData, Object model, TextWriter writer, ViewEngineCollection viewEngineCollection)
   at System.Web.Mvc.Html.PartialExtensions.Partial(HtmlHelper htmlHelper, String partialViewName, Object model, ViewDataDictionary viewData)
   at ASP._Page_Views_Partials_grid_editors_Base_cshtml.Execute() in C:\home\site\wwwroot\Views\Partials\grid\editors\Base.cshtml:line 20