Design and Implementation of an End-to-End Web based Trusted Email System

摘要

Web based email systems are important services on internet that store and route emails between senders and recipients. In principle, these are intermediate systems that have the potential of intercepting the end user’s emails. Privacy of emails is often compromised by law enforcement agencies as well as by email service providers for user profiling and targeted advertisements. Many solutions have been proposed to solve such privacy concerns by means of end-to-end email encryption. However, these solutions pose other challenges to maintain usability, portability and trusted key management on web. These systems maintain and distribute end-user cryptographic keys through their web application. Unfortunately, key generation and sharing mechanism is often un-trusted and kept hidden. Trust is directly dependent on web application implementation and can be manipulated by means of key modification through unannounced change of source code (backdoors) on server. In order to address these issues, we propose a new PKI based architecture for a trusted web-based email system. It offers significant usability and portability. Moreover, all the cryptographic operations are open and transparent to end users.