One of the reasons that most people don't use public key encryption to protect their e-mails is that the process is simply too arduous for everyday communications. Open source projects like GNU Privacy Guard and GPGTools have made it easier for individuals to use PGP encryption, but managing the keys used in OpenPGP and other public-key encryption formats still requires effort. And it's even more of a challenge when you want to read encrypted messages on your phone. If you're a company that has concerns about things like compliance and data loss, doing crypto without having some sort of key management can also create all sorts of risks.

For many, a perfect world would be one where crypto tools would handle everything, data would be encrypted on every type of system with whatever encryption type was required, and no one would have to worry about crypto management when it's time for an audit or when lawyers need to do digital discovery.

That's the idea behind Pkware's just-announced Smartcrypt, a software platform that covers everything from mainframes to mobile devices. Smartcrypt lets organizations decide what kind of encryption and authentication they want to use, and it integrates into many common applications. And of course, it can also leverage the .ZIP format to compress encrypted data at rest and in attachments. Ars got an advance walkthrough of Smartcrypt from Matt Little, Pkware's vice president of product development, and we'll be conducting a full review in the near future.

Smartcrypt consists of a cloud backend for key management (or a private server for corporate customers that require it) and clients for "any enterprise OS you do processing on," said Little. That includes mainframes running IBM's z/OS, I, Linux for Z systems, and AIX; Hewlett-Packard's HP-UX; Oracle's Solaris; and Linux distributions that are compatible with Red Hat's RPM and the Debian package handler. It also covers Windows, Mac OS X, iOS, and Android. Smartcrypt can use a wide variety of encryption standards depending on whom and what the encryption is used for.

If you're just an individual user of Smartcrypt, the service connects to Pkware's cloud service to store all the keys generated for encryption. The cloud service can also retrieve the public keys of other users outside of an organization. Optionally, organizations can use the Smartcrypt Manager server, which "will integrate with your own ID and access management systems," such as Microsoft's Active Directory, Little said. "If you want additional credentials for encryption separate from your identity management system, you can do that."

The client provides an interface for applications to integrate encryption directly into applications—and Pkware already has done that lifting for some common applications—including cloud storage tools such as Dropbox and Microsoft's One Drive. And then there's e-mail. "On Windows, we have a native Outlook plugin," Little told Ars. "It will interrogate the 'to' and 'CC' fields in e-mails to find keys." That work is still being done for MacOS X, where Little said Pkware is looking to integrate with both Outlook and Apple's Mail application.

Things get a little trickier on iOS. Little said that for now, the client on iOS has "pass-through" integration with Mail, meaning that the encrypted contents of a message are passed to the Smartcrypt app and opened outside Mail rather than being decrypted in place. A similar approach is being taken with Android for now, though Little said that Android is "our area of most opportunity [for secure messaging]. There's only one halfway-decent S/MIME client on Android today. We're looking to innovate there in the very near future."

Then there's that feature FBI Director James Comey wishes all encryption had: a "policy" key for unlocking anything encrypted through the platform. The feature is for "when [an] auditor needs to access information or when enterprise IT needs to get at sensitive data because new people have come in and old people have left," Little explained. "We want to be able to show them where the data is and who has keys, giving them the control that they lose when people get access to a lot of stuff."

By using the policy key feature, organizations can ensure that everything that's sent out is also encrypted using a policy group key to allow an auditor or systems administrator retroactive access to the data. The audit key can also be used with content-checking services used for data leak prevention (DLP). But the service can also be used by DLP systems to spot things going out in the clear that should be encrypted and protect them before they leave the network.

There are some risks that come with that sort of corporate backdoor, Little admitted. If someone were able to compromise the audit key—by targeting an administrator's system or by gaining access to the server—they would be able to gain access to everything the policy key unlocks. "If the box is owned, there's not a lot that encryption is going to protect," he said.

Listing image by Thegreenj