CSE in Gmail now supports PIV and CAC smart cards

 

Gif Credit: Google Workspace Updates

Google is extending client-side encryption (CSE) in Gmail to support hardware keys including PIV (Personal Identity Verification) and CAC (Common Access Card) smart cards. Organizations can now allow their users to send and receive CSE-protected emails from supported Windows devices and browsers using their existing PIV/CAC smart cards.

With the integration of this feature, users are required to insert their smart card and enter their Personal Identification Number (PIN) when adding a digital signature to an email or decrypting a CSE-protected email in Gmail. Notably, all encryption and decryption operations take place on client devices, utilizing their native Windows cryptographic libraries and existing hardware keys.

#GoogleWorkspace client-side encryption (CSE) now supports PIV and CAC smart cards to protect sensitive messages in #Gmail. Learn more → https://t.co/DmfEtWo28y pic.twitter.com/q3JzxxNaN0

— Google Workspace (@GoogleWorkspace) December 15, 2023

CSE provides an additional layer of data confidentiality and protection beyond the encryption enabled by default. The entire process of encrypting customer data occurs on the client device before being transmitted to Google servers, rendering the information indecipherable to Google. This entire process takes place within the browser or mobile app on the client device, eliminating the need for custom desktop applications or browser extensions.

While CSE has its own Key Access Control List Service, some organizations may already possess established mechanisms for controlling and managing encryption keys. For these entities, especially in government, education, and enterprise sectors, PIV and CAC smart cards can now be deployed as a preferred or required alternative to KACLS, Google said in a recent blog post.

"The Gmail team working to encrypt and secure communication using existing hardware keys, not just within our institution but across the U.S. government, makes it clear that Google understands our technical requirements and the importance of data confidentiality. This new capability will provide efficiency and collaboration gains to our organization while keeping our most sensitive data private, compliant, and under our sole control," said Sean Baker, CTO, Uniformed Services University of the Health Sciences (USU).