Two Different Problems, Two Different Solutions

Email encryption and email signing solve different problems and are often confused. Encryption protects the content of a message from being read by anyone other than the intended recipient. Digital signing proves that a message came from who it claims to come from and hasn't been altered in transit. Both use asymmetric cryptography — a public key and a private key — but they use it in opposite directions.

How Encryption Works

When you encrypt an email, you use the recipient's public key to encrypt the message. Only the recipient's private key — which they hold and no one else should — can decrypt it. Even if the message is intercepted in transit, it's unreadable without that private key. This protects confidentiality.

The practical requirement: both sender and recipient need to have compatible encryption infrastructure in place. In enterprise environments, this is typically managed through S/MIME certificates issued by a trusted certificate authority.

How Digital Signing Works

When you sign an email digitally, you use your private key to create a signature that's attached to the message. The recipient uses your public key to verify that the signature is valid — confirming that the message came from you and wasn't modified after signing. This protects authenticity and integrity.

Digital signing is particularly important in financial and legal communication, where the authenticity of instructions, approvals, and disclosures has regulatory implications. A digitally signed email provides a level of assurance that a standard email — which can be spoofed or modified — cannot.

Why This Matters in Practice

For organisations handling sensitive financial data, client instructions, or regulatory correspondence, the absence of email security isn't a theoretical risk. It's a practical vulnerability. Email-based fraud, phishing, and interception are among the most common attack vectors against financial institutions.

Implementing S/MIME encryption and signing is one of the more straightforward security measures available — and one of the most directly relevant to the environments where the consequences of a compromised communication are most significant.