| Prerequisites |
|---|
| You’re familiar with our basic security procedures. |
This page provides an overview of the cryptographic algorithms utilized by FlowCrypt products. It includes information about the standards followed by FlowCrypt, as well as descriptions of the cryptographic algorithms employed whenever possible.
FlowCrypt products
FlowCrypt offers a range of products that leverage cryptographic algorithms to provide secure communication and data protection. The key products are:
-
The FlowCrypt browser extension and mobile apps (available for Android and iOS) provide an email encryption solution that ensures secure communication with end-to-end encryption. You can download them from the download page for free.
-
The FlowCrypt Enterprise Server comprises four different web services for specific tasks. These include:
- Enterprise Admin Panel (EAP): An admin panel server for managing users, keys, client configurations, and viewing important information.
- FlowCrypt External Service (FES): A server serving client configurations for customizing user experience and setting user restrictions. You can find more information about client configurations on the corresponding page.
- Email Key Manager (EKM): A key server that stores user keys and related information.
- Web Key Directory (WKD): A server to look up existing Web Key Directory on a customer domain.
The FlowCrypt Enterprise Server works in conjunction with the FlowCrypt browser extension and mobile apps to provide email encryption. -
The FlowCrypt Workspace Key Manager is a software that enables you to encrypt data in Google Workspace using strong client-side encryption.
Standards adherence
FlowCrypt products adhere to industry-standard cryptographic protocols and specifications to ensure robust security. The following are some of the standards followed by FlowCrypt:
-
OpenPGP (Pretty Good Privacy): FlowCrypt implements the OpenPGP standard for secure email communication. OpenPGP defines encryption and digital signature formats and protocols.
-
S/MIME: FlowCrypt partially implements the S/MIME standard for secure email encryption through the FlowCrypt browser extension. To learn more about S/MIME support in FlowCrypt products for email encryption, please refer to the Feature Availability page.
OpenPGP libraries
FlowCrypt leverages the following software libraries to implement OpenPGP functionality:
-
OpenPGP.js: A JavaScript library that provides an OpenPGP implementation in browsers. It offers encryption, decryption, digital signature, and key management capabilities. You can find its source code at the OpenPGP.js GitHub repository.
-
PGPainless: PGPainless is an OpenPGP API based on the Bouncy Castle Java library that provides cryptographic services. FlowCrypt utilizes PGPainless for OpenPGP operations in Java-based environments. You can find its source code at the PGPainless GitHub repository.
OpenPGP algorithms
Algorithms that are supported by OpenPGP.js and PGPainless are the following:
| Type | Algorithm |
|---|---|
| RSA keys |
2048, 3072, 4096, and 8192. |
| Elliptic Curve Cryptography (ECC) Keys |
ECDSA, EdDSA, ECDH, curve25519, ed25519, p256, p384, p521, brainpoolP256r1, brainpoolP384r1, brainpoolP512r1, and secp256k1. |
| Compression |
ZIP, ZLIB, and BZIP2. |
| Hashing |
RIPEMD160, SHA1, SHA224, SHA256, SHA384 and SHA512. Additionally, SHA3_256 and SHA3_512 are exclusively supported by PGPainless. |
Supported JWT algorithms
The following are JWT algorithms used for signature verification in OAuth2 or OIDC flows in all FlowCrypt products:
RS256HS256
Other algorithms
-
AES256-GCM: This algorithm is used to encrypt records for the FlowCrypt Email Key Manager. It’s applicable only when the
store.encryption.key.source=propertiesconfiguration property is set andstore.encryption.enableis set totruein the Email Key Manager or Enterprise Server properties file. -
SHA256-AES-ECB: The
SHA256-AES-ECBalgorithm is a cryptographic algorithm utilized by FlowCrypt Workspace Key Manager for deriving Key Encryption Keys (KEKs).
Cryptographic algorithms overview
The table below provides a quick overview of cryptographic algorithms we use in each FlowCrypt product:
| FlowCrypt Product | OpenPGP Library Used | Other Cryptographic Algorithms |
| Browser extension, iOS mobile app, and Android mobile app ID Token Usage: The ID token authenticates requests from the client apps to the OAuth 2.0 service of the email provider for user authentication. Purpose: Encryption and decryption of messages, message signing, signature verification, message and keyring compression, and message hashing. |
OpenPGP.js in browser and iOS, PGPainless on Android |
Supported OpenPGP Algorithms |
| Enterprise Server ID Token Usage: The ID token authenticates users across FlowCrypt Enterprise Server’s web services. Purpose: Generation of keys for users. AES256-GCM is used for database encryption
|
OpenPGP.js, PGPainless
|
ECDH (subkey), EdDSA (primary key), RSA-3072, RSA-4096, and AES256-GCM (EKM Only) |
| Workspace Key Manager for Client-side encryption ID Token Usage: Used for authentication and authorization in various WKM endpoints. Purpose: Used to derive the Key Encryption Key (KEK). |
- | SHA256-AES-ECB |