Email PQC support stays under half of measured Tranco domains
Original title: They Will See Johnny's Message: A Measurement Study of Post-Quantum Cryptography Across Email Delivery Paths
Google accounts for about 87% of hybrid-capable relays, and some senders fall back to plaintext SMTP.
A measurement study finds post-quantum cryptography for email is concentrated among a few providers and often unused even when available. Fewer than half of domains in each service panel from three snapshots of Tranco Top 1M relay, submission, access, and webmail services support PQC. Google alone accounts for approximately 87% of hybrid-capable relay domains. Only two of eight tested sending providers negotiate PQC with the authors' receiver, although five accept it inbound. When TLS groups are restricted to PQC, four of six incompatible senders fall back to plaintext where unencrypted SMTP is allowed. Message-layer OpenPGP and S/MIME use is further limited by key generation, format, and backend failures.
Unconfirmed: Figures describe the authors' snapshots and controlled tests, not a complete census of all email providers.
- Endpoint TLS support does not cover independently negotiated submission, relay, and access connections.
- Fewer than half of domains in each service panel support PQC.
- Two of eight sending providers negotiate PQC outbound; five accept it inbound.
- Four of six incompatible senders fall back to plaintext when unencrypted SMTP is permitted.
- Vendors
From the original article
1 min read at arxiv.orgHarvest-now, decrypt-later (HNDL) attacks make the transition to post-quantum cryptography (PQC) urgent for email. This paper presents a systematic measurement that jointly examines PQC deployment across email service stages, negotiation by communicating peers, and usable message encryption.
By Jaehwan Park · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.