The Overview of the New SMTP Strict Transport Security Mechanism

SMTP Strict Transport Security Mechanism

The new standard has policies and rules set up for mail service providers to establish encrypted email communications.

E-mail is an important tool for many, but it is widely recognized that it is not always as secure as it could be with a risk of user connections to email servers being intercepted by attackers. In response to this vulnerability, Microsoft, Yahoo, Comcast, LinkedIn, 1&1 Mail & Media Development & Technology, and Google published a new draft security standard on March 18th 2016 called SMTP Strict Transport Security (STS). The draft was published to be considered as an Internet Engineering Task Force (IETF) standard. This effort marked the coming together of engineers from some of the world’s most prestigious e-mail providers with a vision of improving email security.

So how does this standard differ from Simple Mail Transfer Protocol SMTP which is the current prevailing standard? SMTP was established in 1982 and at the time was not produced with any encryption option. SMTP is used as a method of moving e-mail messages between e-mail servers and email clients, and between the providers themselves. SMTP does not require end users to connect using a secure connection to mail servers. In 2002 an extension was added to the protocol as a way to integrate Transport Layer Security (TLS) with SMTP connections. The extension was not widely adopted and therefore e-mail traffic remained mainly unencrypted which clearly has posed a significant security risk.

This risk came to the forefront of people’s minds in 2013 when Edward Snowden, a former US National Security Agency employee, leaked documents that exposed widespread surveillance of e-mail communications by a number of intelligence agencies globally. The US and UK government agencies were exposed as being involved which attracted a huge amount of public and media interest. In 2014, Facebook did some research and found that 58% of notification e-mails it sent to users passed a STARTTLS encryption. This had increased to 95% by August 2014. STARTTLS was an improvement from no encryption whatsoever, but is did have two key vulnerabilities. The first being a susceptibility to man-in-the-middle attacks where hackers were intercepting traffic and the second being where hackers were able to simply remove the encryption; this is called an encryption downgrade attack.

SMTP STS addresses the man-in-the-middle and downgrades attack vulnerabilities that are present in STARTTLS. The SMTP STS mechanism has a clear approach which enables mail servers to manage and report on the secured status of the connection. SMTP STS allows mail service providers to state their ability to accept TLS secured connections. In the event that there is no secure connection in place, the mail transmission will be unsuccessful. In essence the new standard has policies and rules set up for mail service providers to establish encrypted email communications.

In summary, SMTP STS is an attempt to succeed where STARTTLS failed. The standard is in the draft phase currently and it is not set to become reality for a while yet. The IETF has a few more months to consider the possibilities presented by this proposal before the motion expires in September 2016.