Google Workspace CSE for Gmail

google workspace has expanded its client side encryption (cse) capabilities to gmail, offering enhanced confidentiality and data integrity for commercial and public sector organizations this expansion complements existing cse functionalities available in drive, docs, slides, sheets, and meet the gmail cse is specifically designed to give customers full control over encryption keys, ensuring that data remains encrypted from the client side before it reaches the google servers this client side encryption ensures that google has no access to the decryption keys, thus enhancing privacy and security key features this integration has the following features enhanced data protection encrypts email content on the client device before it is sent to google servers, maintaining data confidentiality as google does not possess the decryption keys seamless user experience operates entirely within the browser without requiring additional desktop applications or browser extensions, preserving the native gmail user interface and functionalities advanced key management uses the key access control list service (kacls), a proprietary google service that supports cryptographic operations across all essential workspace applications this service verifies user authentication and authorization before performing any cryptographic operations technical implementation the technical implementation of this integration includes the following elements encryption methodology uses envelope encryption, where you encrypt data by using a data encryption key (dek) that is further secured by kacls authentication and authorization integrates with the customer's openid connect (oidc) identity provider (idp) to authenticate end users and manage access through json web tokens (jwt) that authorize specific operations s/mime standard employs s/mime, an open standard for email encryption, ensuring compatibility with most enterprise email clients and allowing secure communications across different providers without proprietary restrictions operational workflow the following steps comprise the operational workflow email composition when a user composes an email, the gmail client encrypts the message with a dek, which is then encrypted by using the recipient’s public key the dek and the encrypted message are wrapped in an s/mime format digital signing and encryption the encrypted message is digitally signed by using keys managed by kacls, ensuring that the sender’s identity is verifiable and the content has not been tampered with during transit receiving and decrypting emails upon receiving an encrypted email, gmail verifies the digital signature against the sender’s s/mime certificate, decrypts the dek using kacls, and renders the email content to the user security and compliance the integration conforms to standard security and compliance requirements with respect to the following aspects high security standards besides standard tls encryption for data in transit, gmail cse uses multiple security controls, including iframe origin isolation and content security policy, to secure sensitive data within a secure container in the browser regulatory compliance meets high compliance standards required by various industries, ensuring that sensitive information remains protected under rigorous data protection regulations basic setup steps for google workspace cse the following high level steps illustrate the setup process for google workspace cse set up your external encryption key service connect google workspace to your external key service connect google workspace to your identity provider turn on cse for users set up your external encryption key service first, set up an encryption key service through one of the google partner services (such as cryptohub) this service controls the top level encryption keys that protect your data connect google workspace to your external key service next, specify the location of your external key service, so google workspace can connect cse for supported apps to it connect google workspace to your identity provider for this step, you must connect to either a third party idp or google identity by using either the admin console or a well known file hosted on your server your idp verifies the identity of users before allowing them to encrypt content or access encrypted content learn more this integration guide demonstrates using virtucrypt as the identity provider turn on cse for users you can turn on cse for any organizational units or groups in your organization note, however, that you must turn on cse for only users that you want to create client side encrypted content google drive you need to turn on cse only for users who need to create client side encrypted documents, spreadsheets, and presentations or upload client side encrypted files to drive you don't need to turn on cse for users who only view and edit files shared with them google meet you must turn on cse only for users who need to host client side encrypted meetings you don't need to turn on cse for other participants in meetings for details about turning on cse for users, see create client side encryption policies ( support google com/a/answer/10745596 )