![](bg8.png)
7 CONCLUSION
This paper’s goal has been that of systematically dis-
cuss threats against private messaging in the two do-
mains of E-mailing and IM when servers are un-
trusted. The two application types have strong sim-
ilarities, which allowed us to apply for both the same
threat modelling methodologies; but they are not
identical and already from our analysis relevant dif-
ference emerged due to the different nature, on-line
and off-line, of the two communication paradigms.
Fulfil the same requirements, such as perfect forward
secrecy, calls for different solutions.
We provided a detailed and comparative analysis
of the systems, describing the entities involved, the
operations, and the system features. We have identi-
fied, discussed, and catalogued the classes of threats
that can exploit the assets of users and the system. We
have, for each threat, discussed the opposing security
and privacy requirements.
Our investigation remains within the scope of spe-
cific features of privacy messaging: messages ex-
change, search and archiving, and contact synchro-
nization. We intend for the future to extend the anal-
ysis to other features, such as, key management and
key synchronization among different devices.
ACKNOWLEDGMENTS
We would like to thank Nana Karlstetter and Bernie
Hoeneisen from p≡p foundation for the inputs and all
the anonymous reviewers for their constructive feed-
back. The authors are supported by the pEp Security
SA / SnT partnership project ”Protocols for Privacy
Security Analysis”.
REFERENCES
Bicz
´
ok, G. and Chia, P. H. (2013). Interdependent privacy:
Let me share your data. In Financial Cryptography
and Data Security - 17th International Conference,
FC 2013, Okinawa, Japan, April 1-5, 2013, Revised
Selected Papers, pages 338–353.
Bini, O. and Celi, S. (2018). No evidence of communication
and implementing a protocol: Off-the-record protocol
version 4. Hotpets.
Borisov, N., Goldberg, I., and Brewer, E. A. (2004). Off-
the-record communication, or, why not to use PGP. In
Proceedings of the 2004 ACM Workshop on Privacy in
the Electronic Society, WPES 2004, Washington, DC,
USA, October 28, 2004, pages 77–84.
Camenisch, J. and Lysyanskaya, A. (2004). Signa-
ture schemes and anonymous credentials from bilin-
ear maps. In Advances in Cryptology - CRYPTO
2004, 24th Annual International CryptologyConfer-
ence, Santa Barbara, California, USA, August 15-19,
2004, Proceedings, pages 56–72.
Clark, J., van Oorschot, P. C., Ruoti, S., Seamons, K. E.,
and Zappala, D. (2018). Securing email. CoRR,
abs/1804.07706.
Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris,
J., Hansen, M., and Smith, R. (2013). Privacy Consid-
erations for Internet Protocols. RFC 6973.
Council of Europe: European Court of Human Rights
(2016). Guide on Article 8 of the European Conven-
tion on Human Rights - Right to respect for private
and family life. https://www.echr.coe.int/Documents/
Guide Art 8 ENG.pdf. Accessed December, 2019.
Danezis, G., Domingo-Ferrer, J., Hansen, M., Hoepman, J.,
M
´
etayer, D. L., Tirtea, R., and Schiffner, S. (2015).
Privacy and data protection by design - from policy to
engineering. CoRR, abs/1501.03726.
Deng, M., Wuyts, K., Scandariato, R., Preneel, B., and
Joosen, W. (2011). A privacy threat analysis frame-
work: supporting the elicitation and fulfillment of
privacy requirements. Requirements Engineering,
16(1):3–32.
D
´
ıaz, C., Seys, S., Claessens, J., and Preneel, B. (2002).
Towards measuring anonymity. In Privacy Enhancing
Technologies, Second International Workshop, PET
2002, San Francisco, CA, USA, April 14-15, 2002, Re-
vised Papers, pages 54–68.
Diffie, W. and Hellman, M. E. (1976). New directions
in cryptography. IEEE Trans. Information Theory,
22(6):644–654.
Dkg (2019). OpenPGP Certificate Flooding.
https://dkg.fifthhorseman.net/blog/openpgp-
certificate-flooding.html. Accessed December,
2019.
Ermoshina, K., Musiani, F., and Halpin, H. (2016). End-
to-end encrypted messaging protocols: An overview.
In Internet Science - Third International Conference,
INSCI 2016, Florence, Italy, September 12-14, 2016,
Proceedings, pages 244–254.
European Commission. Guidelines on Data Protection
Impact Assessment (DPIA) and determining whether
processing is “likely to result in a high risk” for the
purposes of Regulation 2016/679 (17/EN WP 248).
http://ec.europa.eu/newsroom/document.cfm?doc
id=44137. Accessed May, 2018.
European Parliament and the European Council (2016).
Regulation (EU) 2016/679 of the European Parlia-
ment and of the Council of 27 April 2016 on the pro-
tection of natural persons with regard to the process-
ing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data
Protection Regulation), OJ L119, 4.5.2016. 59:1–87.
Finney, H., Donnerhacke, L., Callas, J., Thayer, R. L., and
Shaw, D. (2007). OpenPGP Message Format. RFC
4880.
Garfinkel, S. (1995). PGP - pretty good privacy: encryption
for everyone (2. ed.). O’Reilly.
Hoffman, P. (2002). SMTP Service Extension for Secure
SMTP over Transport Layer Security. RFC 3207.
Howard, M. and Lipner, S. (2009). The security develop-
ment lifecycle. O’Reilly Media, Incorporated.
ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy
600