Using the KACLS with Gmail
The KACLS can be used with Gmail. This feature is available with the web version of Gmail and with the mobile application on Android and iOS.
Two modes are available:
-
Gmail standard mode with encrypted keys stored at Google,
-
Gmail advanced mode based on a Key management system (KMS) with keys stored in the KMS.
Depending on the mode you choose, you need to know the limitations about the supported algorithms. For more information, refer to the table in the section Configuration of the cryptographic backend.
Stormshield recommends the use of different key pairs for encryption and signature. In this case, repeat the step Encrypting users' private keys with the KACLS for each private key.
To help you using of Gmail with the client-side encryption service, you can implement the SDS Orchestrator solution. It provides and manages encryption and signature keys for your Google Workspace accounts. For more information, please contact your Stormshield sales representative.
Using Gmail in standard mode
Configuring the KACLS
Modify the config.json file as described in the steps below: For more information, refer to the Configuring the Key Access Management section.
-
Fill in the crypto_backend section, and assign the "node" value to the
typefield. Do not fill in the configuration block. See crypto_backends parameter and Configuration of the cryptographic backend. -
In the id field of the keys section, enter the UUID of the cryptographic backend set in step 1. See keys parameters and Configuration of the cryptographic backend.
-
Fill in the authorization section with Gmail information as shown in Authorization settings.
-
Fill in the wrapprivatekey_authentication section as shown in wrapprivatekey_authentication parameters.
-
Optional. Fill in the admin_authentication section as shown in admin_authentication parameters to perform privileged operations.
Encrypting users' private keys with the KACLS
Ensure that the KACLS is fully configured and operational before following the steps below.
For every private key to be encrypted, call up the /wrapprivatekey API route in POST with the following headers and payload:
-
URL: in the format "{protocol: http | https}://{kacls url}/api/v1/{tenantId}/wrapprivatekey", where:
-
{kacls url} is the URL of the key service that you have declared in Configuring Google Workspace Client-side encryption
-
{tenantId} is your tenant's UUID.
-
-
Mandatory headers:
-
Content-Type: 'application/json',
-
Connection: 'keep-alive',
-
-
Payload:
Field Description authentication Valid authentication token private_key The user's private key encrypted in PEM format, and base64-encoded
perimeter_id Optional string supported_algorithms List of supported algorithms:[
'RSA/ECB/PKCS1Padding', 'RSA/ECB/OAEPwithSHA-1andMGF1Padding', 'RSA/ECB/OAEPwithSHA-256andMGF1Padding', 'RSA/ECB/OAEPwithSHA-512andMGF1Padding'
'SHA1withRSA',
'SHA256withRSA',
'SHA512withRSA',
'SHA1withRSA/PSS',
'SHA256withRSA/PSS',
'SHA512withRSA/PSS'
];
EXAMPLE:
Request enabling the encryption of a private key, sent in POST over the /wrapprivatekey route:
{
"authentication": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImFjZGEz...",
"private_key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVk...",
"supported_algorithms": [
"RSA/ECB/PKCS1Padding",
"RSA/ECB/OAEPwithSHA-1andMGF1Padding",
"RSA/ECB/OAEPwithSHA-256andMGF1Padding",
"RSA/ECB/OAEPwithSHA-512andMGF1Padding,"
"SHA1withRSA",
"SHA256withRSA",
"SHA512withRSA"
"SHA1withRSA/PSS",
"SHA256withRSA/PSS",
"SHA512withRSA/PSS"
]
}
The response to this request is a JSON object named wrapped_private_key which contains a string representing the encrypted private key.
Providing private keys to Google
-
Enable Gmail and provide your users' encrypted private keys and certification chains. For more information, refer to the Google documentation Gmail only: Set up your organization for client-side encryption.
Certification chains must meet the following Google specifications:
Using Gmail
-
To use Gmail to send encrypted messages to internal or external users, refer to Google documentation Learn about Gmail Client-side encryption.
Using Gmail in advanced mode based on a KMS
Configuring the KACLS
Modify the config.json file as described in the steps below: For more information, refer to the Configuring the KACLS section.
-
Fill in the whole crypto_backend section, and assign the "kms" value to the type field. See crypto_backends parameter and Configuration of the cryptographic backend.
NOTE
If using a KMS domain, the domain_id values of all the tenant configurations must imperatively be the same and match the domain used by the KMIP configuration. -
In the id field of the keys section, enter the UUID of the cryptographic backend set in step 1. See keys parameters and Configuration of the cryptographic backend.
-
Fill in the authorization section with Gmail information as shown in Authorization settings.
-
Fill in the wrapprivatekey_authentication section as shown in wrapprivatekey_authentication parameters.
-
Optional. Fill in the admin_authentication section as shown in admin_authentication parameters to perform privileged operations.
Encrypting users' private keys with the KACLS
Ensure that the Stormshield KMaaS is fully configured and operational before following the steps below.
-
For every private key to be encrypted, send a POST request to the /wrapprivatekey API route with the following headers and payload:
-
URL: in the format "{protocol: http | https}://{kacls url}/api/v1/{tenantId}/wrapprivatekey", where:
-
{kacls url} is the URL of the key service that you have declared in Configuring Google Workspace Client-side encryption
-
{tenantId} is your tenant's UUID.
-
-
Mandatory headers:
-
Content-Type: 'application/json',
-
Connection: 'keep-alive',
-
-
Payload:
Field Description authentication Valid administrator authentication token private_key ID of the user's private key stored in the KMS, and base64-encoded.
perimeter_id Optional string supported_algorithms List of supported algorithms:
[
'RSA/ECB/PKCS1Padding',
‘SHA1withRSA’,
‘SHA256withRSA’,
‘SHA512withRSA’,
'SHA1withRSA/PSS',
'SHA256withRSA/PSS',
'SHA512withRSA/PSS'
];
public_key Public key of the user in PEM format, and base64-encoded.
EXAMPLE:
Request enabling the encryption of a private key, sent in POST over the /wrapprivatekey route:
{
"authentication": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImFjZGEz...",
"private_key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVk...",
"supported_algorithms": [
"RSA/ECB/PKCS1Padding",
"SHA1withRSA/PSS",
"SHA256withRSA/PSS",
"SHA512withRSA",
"SHA512withRSA/PSS"
],
"public_key" : "e32tLS1CRUdJTiBSU0FgUFJJVkFURSBLRck..."
}
-
For every private key to be encrypted, call up the /wrapprivatekey API route in POST with the following headers and payload:
-
URL: in the format "{protocol: http | https}://{kacls url}/api/v1/{tenantId}/wrapprivatekey", where:
-
{kacls url} is the URL of the key service that you have declared in Configuring Google Workspace Client-side encryption
-
{tenantId} is your tenant's UUID.
-
-
Mandatory headers:
-
Content-Type: 'application/json',
-
Connection: 'keep-alive',
-
-
Payload:
Field Description authentication Valid administrator authentication token private_key ID of the user's private key stored in the KMS, and base64-encoded.
perimeter_id Optional string supported_algorithms List of supported algorithms:
[
'RSA/ECB/PKCS1Padding',
‘SHA1withRSA’,
‘SHA256withRSA’,
‘SHA512withRSA’,
'SHA1withRSA/PSS',
'SHA256withRSA/PSS',
'SHA512withRSA/PSS'
];
public_key Public key of the user in PEM format, and base64-encoded.
EXAMPLE:
Request enabling the encryption of a private key, sent in POST over the /wrapprivatekey route:
{
"authentication": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImFjZGEz...",
"private_key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVk...",
"supported_algorithms": [
"RSA/ECB/PKCS1Padding",
"SHA1withRSA/PSS",
"SHA256withRSA/PSS",
"SHA512withRSA",
"SHA512withRSA/PSS"
],
"public_key" : "e32tLS1CRUdJTiBSU0FgUFJJVkFURSBLRck..."
}
Providing the encrypted ID of the private keys to Google
-
Enable Gmail and provide your user's private key encrypted IDs and certification chains. For more information, refer to the Google documentation Gmail only: Set up your organization for client-side encryption.
Certification chains must meet the following Google specifications:
Using Gmail
-
To use Gmail to send encrypted messages to internal or external users, refer to Google documentation Learn about Gmail Client-side encryption.
Using Gmail in Send to Anyone mode
If you have the Google Workspace Assured Controls license, you can use Gmail Send to Anyone feature (STA) to send encrypted emails both to internal and external users, without having to configure S/MIME certificates.
To use STA with users outside the company, enable Guest access by following the procedure described in section Enabling external user access for Google Drive and Google Meet. In the Configure guest IdP section of the Google Admin, select the Gmail option.
To configure the STA mode:
-
In the config.json file, fill in the authorization section with Gmail STA information as described in section authorization parameters.
For more information, refer to Google's documentation: