Email Trust 2.5: Decentralization is Key

Why every email must be digitally signed using a Self-Sovereign Identity (SSI)

Introduction

Email is the most widely used form of enterprise communication in the world, with over 4 billion active users. However, email is also one of the most vulnerable forms of communication to cyberattacks. Phishing attacks, spam, and malware are all common and frequent threats to email users and their employers

So what to do? One way to protect against email attacks is to digitally sign emails, as was discussed in a recent article on the provenance and security challenges stemming from Generative AI. This capability is available today, but most people don’t use it, even those that are aware of it. Why not, one might ask?

The answer is a combination of education and user experience.

On the education side, people have been trained that an email from their boss, a colleague, or even from a client is to be trusted. Why? Because enterprises lack the proper means to educate their employees about cybersecurity. Instead of promoting a cautious approach where anything received is treated with a degree of skepticism, these organizations inadvertently compel employees to make complex security risk decisions. This challenge is compounded by the fact that employees are often not equipped with adequate training or the appropriate tools for such assessments.

From a user experience perspective, the tools available for employees to verify authenticity are often not user-friendly and deviate from the familiar usage patterns of everyday apps.

Imagine how convenient it would be if, during onboarding, new employees received digital credentials as one or more cryptographic key pairs. These would automatically sign every email with a simple touch on the biometric fingerprint reader found in most modern laptops. Securing an email would be as easy as hitting the “Send” button and putting your thumb on the fingerprint reader. Done! However a) that is not how it works today and b) transferring these credentials across all devices involves significant effort.

What is Self-Sovereign Identity (SSI)?

Achieving both simplicity and portability can be accomplished through the use of Self-Sovereign Identity (SSI), a new identity management model that empowers individuals to manage their digital identities using cryptography and the available tools it offers. With SSI, users can generate their own digital credentials and share them with others without having to rely on a centralized identity provider for security.

What are Digital Credentials?

Digital credentials are verifiable claims that can be used to prove an individual’s identity or other attributes. For example, a digital credential could be used to prove that an individual is over the age of 18 or that they have a valid driver’s license.

Digital credentials are issued by trusted issuers, such as government agencies or businesses. The issuer signs the digital credential with their private cryptographic key, which creates a unique digital signature. The recipient of the digital credential can then verify the signature using the issuer’s public key. This proves that the digital credential came from the issuer and that it has not been tampered with.

So what are the benefits of using SSI to sign emails?

There are several immediate benefits to using SSI to sign emails:

Increased security: Digital signatures can help to prevent email fraud and cybersecurity breaches. By verifying the identity of the email sender through an easily verifiable digital credential and the integrity of the email message through a digital signature, SSI can help protect users from phishing attacks, spam, and malware.

Improved privacy: SSI gives individuals control over their own digital identities. Users can choose when to share their digital credentials and with whom. This can help to protect users’ privacy and reduce the risk of identity theft. For example, in the case of email communication, a known and trusted issuer such as an auditor could assert that the email sender has a legal identity and has cyber security insurance that protects it against damages from malicious email attacks without revealing insurance policy details.

Reduced costs: SSI can help to reduce the costs of identity management for businesses because they do not need to maintain their own identity repositories or pay third-party identity providers.

Security-harden email using SSI

To sign an email using SSI, a business will need to have a digital wallet and a digital credential that proves their legal identity. This can be provided to the business, for example, by the Integrated Trust Network and its technology stack, which we will discuss below.

Once the business has its digital wallet and its required digital credential(s), it can sign any email set from its internet domain with the following steps:

1. Open an email client and compose a new email
2. In the email body, type the message to be sent
3. Click the “Sign” button in the email navigation bar and select a digital wallet, such as the one from the ITN
4. Enter the digital wallet’s PIN or password
5. Select the digital credential(s) to be included in the email
6. Click the “Sign” button

The email client will then create a digital signature over the email and the digital credentials. The recipient of the email will be able to verify:

1. The signature using the public key of the sender
2. The identity of the digital credential issuer through information embedded in the credential such as a URL to a government verification service
3. The signatures of the credential issuers on each submitted digital credential using the issuer’s public key

To ensure standardization of both digital credentials and identifiers, it is recommended to use World Wide Web Consortium (W3C) Verifiable Credentials (VCs) to establish the identity of the email sender and W3C Decentralized Identifiers (DIDs) for ensuring the authenticity and active status of the public keys used in the digital signature generation.

W3C VCs are a new standard for digital credentials. VCs are based on JSON-LD and use digital signatures to prove the authenticity of the credential.

W3C DIDs allow the standardized association of W3C VCs with a verifiable set of cryptographic capabilities (authentication, assertion, encryption, etc.) and the associated cryptographic public keys, and a standardized method on how to manage and secure DIDs.

Intro to the Integrated Trust Network

How the ITN with its Self-Sovereign Digital Twin (SSDT) can help implement an email signing solution

The Integrated Trust Network (ITN) is a global, cross-industry federated network that provides decentralized identity services for a new generation of secure digital commerce and is built on the principles of self-sovereign identity (SSI)

The ITN’s Self-Sovereign Digital Twin (SSDT) is a digital representation of a physical or digital entity — a multi-purpose Digital Wallet. The SSDT is controlled by the entity itself, and it can be used to share verified information such as digital credentials about the entity with others.

The ITN and SSDT together can be used to implement an email signing solution in the following ways:

1. The ITN can issue the necessary DIDs required in digital credentials
2. The ITN SSDT can verify digital signatures
3. The ITN SSDT can manage all digital credentials associated with digital identities including secure storage for digital credentials and managing access to digital credentials.

An email signing solution using the ITN and SSDT could be as follows:

1. A business creates its DIDs with the ITN
2. Obtain digital credentials for the business used in sending emails from either ITN or another credential issuer using the ITN SSDT
3. Integrate the used email clients with the ITN SSDT of the business, and possibly for each of its employees, using its SDK to verify digital signatures
4. Educate their employees on how to sign emails using the new ITN email solution

Conclusion

There are some additional benefits of using the ITN and SSDT for email signing:

Trusted identity registry: The ITN is a trusted identity registry that can be used to verify the identities of email senders. This can help to prevent phishing attacks and improve the overall security of email communication.

Decentralized infrastructure: The ITN is a decentralized infrastructure, which means that it is not controlled by any single entity. This makes it more resistant to cyberattacks and more reliable.

Open source: The ITN and SSDT are open-source projects, which means that they are freely available to anyone to use and contribute to. This makes them more transparent and secure than proprietary solutions.

Overall, the ITN and SSDT offer several advantages for implementing an email signing solution. By using the ITN and SSDT, businesses can improve the security, privacy, and efficiency of their email communications.