CipherMail Email Encryption - blog

Five vulnerabilities in CipherMail Gateway: EFAIL revisited, a bounce oracle, and trust-tag spoofing

Martijn Brinkers — Mon, 08 Jun 2026 00:00:00 +0200

Background information on five vulnerabilities reported in CipherMail Gateway by the Applied Cryptography Group at ETH Zurich, including S/MIME and OpenPGP EFAIL variants, a decryption/padding oracle through bounce messages, a PGP signature-coverage spoof, and a subject-filter bypass — and how to configure the gateway to protect yourself.

No Spam Proxy GCM Bug

Martijn Brinkers — Mon, 09 Feb 2026 00:00:00 +0100

When S/MIME GCM Goes Wrong: “mac check in GCM failed” with No Spam Proxy

SMTP Smuggling - Spoofing E-Mails Worldwide

Martijn Brinkers — Fri, 22 Dec 2023 00:00:00 +0100

SEC Consult Vulnerability Lab, Timo Longin discovered a novel exploitation technique for SMTP

CipherMail Gateway and Webmail Messenger are not impacted by the Log4j vulnerabilities

Martijn Brinkers — Sun, 12 Dec 2021 00:00:00 +0100

Friday morning we were notified that Log4j, a popular Java logging library, contains a critical vulnerability that can result in Remote Code Execution (RCE) when a certain attacker-controlled message gets logged. As we use Log4j in CipherMail Gateway and Webmail Messenger, and the vulnerability appeared to be trivial to exploit …

HTML email is now fully supported by the PDF encryption module

Martijn Brinkers — Fri, 03 Dec 2021 00:00:00 +0100

The PDF encryption module of PDF messenger now fully supports HTML email and embedded images.

Automating CipherMail deployments

Imre Jonk — Mon, 05 Jul 2021 00:00:00 +0200

No need to manually edit configuration files and copying them to all cluster nodes anymore, CipherMail is now automated!

Eating our own dog food

Imre Jonk — Thu, 16 Jul 2020 00:00:00 +0200

This article will give some insight in how we use our products ourselves as a way of quality control and testimonial advertising.

CipherMail CVE-2020-12713 & CVE-2020-12714

Martijn Brinkers — Thu, 28 May 2020 00:00:00 +0200

Background info on CVE-2020-12713 & CVE-2020-12714

EFAIL: detection and prevention

Martijn Brinkers — Sat, 19 May 2018 00:00:00 +0200

EFAIL: detection and prevention

EFAIL: how to detect you are being attacked?

Martijn Brinkers — Tue, 15 May 2018 00:00:00 +0200

EFAIL: how to detect you are being attacked?

EFAIL: which is vulnerable? PGP, S/MIME or your mail client?

Martijn Brinkers — Mon, 14 May 2018 00:00:00 +0200

EFAIL: which is vulnerable? PGP, S/MIME or your mail client?

Will DANE for SMTP solve all of your GDPR problems?

Martijn Brinkers — Wed, 09 May 2018 00:00:00 +0200

The short answer: probably not. The long answer: keep reading.

Encrypted email and archiving requirements

Martijn Brinkers — Tue, 31 Jan 2017 00:00:00 +0100

Desktop email encryption might be conflicting with the requirement to archive email in a readable and searchable form. Placing an email encryption gateway before the archiving system might help to fulfill both requirements.

What does it take for Johnny to start encrypting his email?

Martijn Brinkers — Mon, 30 May 2016 00:00:00 +0200

Why are most emails not encrypted? This might be because most email encryption products are too difficult to use. We propose that email encryption should be done at the gateway level.

Using an HSM to protect your encryption and signing keys

Martijn Brinkers — Mon, 23 May 2016 00:00:00 +0200

A Hardware Security Module (HSM) can be used to securely store your private keys on a tamper-proof device. This is especially important when using qualified certificates.

Why leaking email addresses is a data breach

Martijn Brinkers — Sun, 15 May 2016 00:00:00 +0200

Why leaking email addresses is a data breach and what can be done to prevent the common cc vs bcc mistake.

Encrypted email, spam and the German law

Martijn Brinkers — Tue, 10 May 2016 00:00:00 +0200

How to scan incoming encrypted email for viruses and spam and still be compliant with German law.

Waarom Jan zijn e-mail niet versleutelt?

Martijn Brinkers — Thu, 13 Nov 2014 00:00:00 +0100

(in Dutch) Waarom wordt e-mailversleuteling niet vaker toegepast? Hoe je ervoor kunt zorgen dat er vaker wordt versleuteld.

Encrypted email in the cloud

Martijn Brinkers — Fri, 06 Jun 2014 00:00:00 +0200

In a perfect world, email can only be read by the user the email was intended for. In the real world however, things are a bit different.