< < < theImposter > > >

Email-over-TLS vs PGP

Both are different protocols used for different purposes. PGP stands for Pretty Good Privacy, used for encrypting and/or signing text, emails, files, and directories. It is designed for when both parties are not online at the same time; hence, the decryption could happen much later than the encryption.

TLS protocol is for a secure, online communication channel between two parties who are online at the same time. It can be opportunistic (meaning that it will send via TLS where possible, else send in the clear) or enforced (where it will not send the email if transmission over TLS cannot be guaranteed).

Emails sent over TLS – assuming that a secure cypher has been selected and the connection has been correctly set up - will be sent down the encrypted channel. This means that the emails are sent securely. If all emails can only be sent over TLS, then PGP email is mainly redundant for this purpose – it may even be considered less secure as the metadata for an email (e.g., the ‘from’ address, source IP) are sent unencrypted, depending upon what your key concerns are.

Where the two methods differ is that sending over TLS is encrypted only for the transmission between to Message/Mail Transfer Agents (MTAs). Each MTA will decrypt the message, and only re-encrypt if sending on to another MTA. With encrypted email, the message (but not the recipient details) is encrypted by the senders mail handler -typically in the outbox, and won’t be decrypted until it reaches the destination inbox. A combination of TLS and encrypted email can be used to provide the best of both worlds.

PGP still has other purposes which email-over-TLS cannot replace, such as acting as a digital signature and ensuring the integrity of file downloads.

-->