by 
On Tuesday, Google made client-side encryption available to a limited set of Gmail and Calendar users in a move designed to give them more control over who sees sensitive communications and schedules.
Client-side encryption is a generic term for any form of encryption applied to data before it is sent from a user device to a server. With server-side encryption, on the other hand, the client device sends the data to a central server, which then uses keys in its possession to encrypt it while it is stored. This is what Google is doing today. (To be clear, the data is sent encrypted through HTTPS, but is decrypted as soon as Google receives it.)
Google’s client-side encryption occupies a middle ground between the two. Data is encrypted on the client device before it is sent (via HTTPS) to Google. The data can only be decrypted on an endpoint machine with the same key used by the sender. This provides an incremental benefit as the data remains unreadable to any malicious Google insiders or hackers who manage to compromise Google’s servers.
Abbreviated as CSE, client-side encryption was already available for Google Drive, Docs, Slides, Sheets and Meet for users of Google Workspace, which the company sells to businesses. Starting Tuesday, Google is rolling it out to customers of Gmail and Calendar Workspace.
“Workspace already encrypts data at rest and in transit using secure-by-design cryptographic libraries,” wrote Ganesh Chilakapati, Google’s group product manager for Google Workspace, and Andy Wen, director of product management for Google Workspace security. “Client-side encryption takes this encryption capability to the next level by ensuring that customers have sole control over their encryption keys – and thus full control over all access to their data.”
It’s probably an exaggeration to say that Google’s CSE gives customers “sole control” over their encryption keys. That’s because CSE keys can be managed by a handful of third-party encryption key services that partner with Google. Technically, this means that these providers will at least have some control over the keys. Google allows CSE users to set up their own key service using a Google programming interface.
CSE is significantly different from the PGP (Pretty Good Privacy) email encryption that was popular with security enthusiasts a decade ago. This system offered true end-to-end encryption since the content could only be decrypted with a key in the recipient’s possession. The difficulty of managing a different key for each party eventually proved too cumbersome, especially at scale, so the use of PGP has largely disappeared and been replaced by end-to-end encryption apps like Signal.
Here is an overview of the Workspace data CSE protects and does not protect:
| Service | Data that is encrypted on the client side | Data that is not encrypted on the client side |
|---|---|---|
| Google Drive |
|
|
| Gmail |
|
|
| Google Calendar |
|
Any content other than the event description, attachments and Meet data, such as:
|
| Google Meet |
|
|
The middle ground CSE is intended to occupy is aimed at organizations with strict compliance requirements imposed by law or contractual obligations. CSE gives these customers more control over the data Google stores, while making it easy for authorized users to decrypt for sharing and collaboration.
“Users can continue to collaborate across other important apps in Google Workspace, while IT and security teams can ensure that sensitive data remains compliant,” Google said in Tuesday’s post. “Because customers retain control of the encryption keys and the identity management service to access those keys, sensitive data is intractable to Google and other external entities.”
Last year, Google published this video designed to show what the user experience is like.
Solving for digital sovereignty with Google Workspace.
The blue circle with the shield in the following images indicates that the contents of the documents, calendars or video chats are protected by CSE:
Of course, CSE only works if the software is not modified. In case it has been maliciously modified to store keys or copies of unencrypted data, all bets are off.
Overall, CSE provides an incremental improvement over the current protection available from Google. People and organizations with specific uses or requirements may find them useful, but the masses are unlikely to clamor for it anytime soon.
