Encrypted Mail

Encrypting a regular email

When composing a plain email, two checkboxes at the bottom of the compose window control protection: Encrypt and Sign. Turning either one on reveals a scheme picker:

• PGP — standard OpenPGP encryption, compatible with other PGP-capable mail clients.
• S/MIME — standard S/MIME (certificate-based) encryption, compatible with other S/MIME-capable clients.
• Eon-PQC (hybrid, E2E) — Eon Phoenix’s own post-quantum scheme, described below. Recommended when your recipient also uses Eon Phoenix.

Signing proves the message really came from you (recipients can verify the signature); encrypting hides the content from everyone but the recipient. You can do either independently, or both together.

Some accounts have mandatory encryption turned on (an option in account settings) — for those, the compose window refuses to send plain, unencrypted mail and reminds you to pick a secure option instead.

The Eon-PQC scheme

Eon-PQC is a hybrid post-quantum encryption scheme: it combines a post-quantum algorithm with a classical one for both confidentiality and signing, so that breaking the encryption would require breaking both the post-quantum and the classical half at once. It protects attachments as well as the message body, and a copy of what you send is always re-encrypted to yourself too, so your own Sent folder stays readable.

This is the same underlying protection used for D-Mail (see D-Mail) and for the special message types below — the difference between them is not how strong the encryption is (it’s always the same), but who can read it, for how long, and whether the metadata is hidden too.

Your key set

Your identity holds a set of encryption keys, one per post-quantum algorithm, not a single fixed key. ML-KEM-1024 and FrodoKEM-1344 are derived for every identity; both are paired with X25519. Whoever writes to you is sent the strongest algorithm the two of you have in common, chosen by their client without asking you or them anything.

Settings → Encryption → Security lists the set: per key the algorithm, its family, NIST level, status, and whether the keyserver has it yet. An algorithm that arrives with an update gets its key derived and published on its own — nothing to do, and your fingerprint does not change, so contacts don’t have to re-verify you. A retired algorithm keeps opening old mail; it is only no longer offered to senders.

If your identity has no recovery code, the table says so too: keys created on that device cannot be recovered anywhere else.

What protected one message

Right-click a message and choose Info (on Android: open it and pick Info among the actions) for what actually happened to that one message:

These facts are captured the moment the message is opened. A read-once message you haven’t opened yet only reports that it is still sealed — filling the dialog would spend the single read.

Finding and verifying a contact’s key

To send Eon-PQC-encrypted mail, Eon Phoenix needs your recipient’s public key. This usually happens automatically:

• The first time you send to a new address, Eon Phoenix looks the recipient up and, if found, pins their key — this is “trust on first use”: the very first key you see for someone is trusted, and any later change to that key is flagged so you can decide whether to accept it.
• In the compose window, each recipient shows a small indicator next to their address: a lock icon means Eon Phoenix already has a pinned key for them and can send Eon-PQC mail immediately; a dash means it doesn’t yet, and it will try to find one automatically when you hit send.
• If a recipient can’t be found (for example, an address that doesn’t use Eon Phoenix or a compatible key directory yet), Eon Phoenix simply falls back to whatever encryption you’ve set up for that message — it never silently sends something as plaintext that you asked to be encrypted.

If you and a contact aren’t discoverable yet

Two people can still get to encrypted mail with each other before any automatic discovery works, in two ways:

• Share your key bundle directly. In Settings → Encryption → My key bundle, click Show my key bundle and copy the block of text (or send it to your contact by any channel you trust). They paste it into Import contact key bundle, with your email address, on their side — and vice versa.
• Cold-start via a regular email. If you send an ordinary (unencrypted or non-Eon-PQC) email, Eon Phoenix quietly attaches your own key bundle to it. A contact who also uses Eon Phoenix picks it up automatically the next time they reply, and from then on you’re both set up for encrypted mail — no manual steps needed on either side.

When a contact’s key changes

If a contact’s key ever changes — for example because they set up a new device or their key was rotated — Eon Phoenix pauses sending to them and shows a banner explaining that their key changed, with the old and new fingerprints shown side by side. You choose Accept to trust the new key and resume, or leave it paused if the change looks unexpected (for example, if you haven’t heard from them about switching devices). A setting in Settings → Encryption → Key-change trust controls how cautious this is by default: Trust keyserver auto-accepts changes that come from your contact’s own verified key directory, while Strict requires you to manually approve every single key change yourself.

Special message types

Beyond plain email and D-Mail chat threads (see D-Mail), the message-type picker at the top of the compose window offers a few more options for specific situations. Each is built on the same Eon-PQC encryption — they differ in who can read it and for how long, not in strength:

• Apax (single-release) — a message that can be opened exactly once. Good for sharing a one-time secret or access code. Combine it with the self-erase option and the message is destroyed the moment it’s opened, leaving nothing behind afterward.
• Confidential — an online-only message: your recipient’s app fetches and decrypts it fresh every time they open it, and it’s never actually stored anywhere as plaintext. This lets you, the sender, truly unsend it later — one click destroys every copy, everywhere, immediately, even if the recipient already read it once.
• Dual-control — a message that only opens once both the recipient opens it and a separate named “approver” you designate also consents. Useful when a message should require two people to agree before it’s released.

These, along with D-Mail, all support an optional Discrete toggle, described next.

The Discrete toggle

D-Mail and the special message types above share one more compose-window option: a Discrete toggle. Clicking it cycles through three states — off, discrete (the default level once you turn it on), and Discrete (full) — and each level protects something different. Neither level makes a conversation anonymous to the two people actually having it, and neither hides that a message was sent, when, or roughly how large it was.

• Discrete (one click) — stops the outgoing message from labeling itself, in cleartext, with which kind of message it is and which conversation or group it belongs to, once it’s sitting in your recipient’s mailbox. This is genuinely useful — without it, anyone with access to the mailbox at rest (a compromised account, a backup, an admin) can see at a glance which of your messages are D-Mail, Dual-control, etc., and which ones belong together, without decrypting anything. What it does not do: your and your recipient’s real email addresses are still the actual From/To on the message — mail simply can’t be delivered otherwise — so anyone who can see those addresses (either mailbox, or a mail server relaying the message) can still tell who is talking to whom. This level only hides the extra grouping tags, not the conversation itself.
• Discrete (full) (a second click) — a separate, stronger step you opt into explicitly. It asks a cooperating Eon Phoenix mail gateway to swap your and your recipient’s real addresses for one-time, throwaway tokens while the message is in transit between mail servers, so a server in between sees only meaningless tokens, never your real addresses. This only works when both your organization and your recipient’s have set up cooperating gateways with each other in advance — it isn’t something a single user can turn on unilaterally. Even then, the domain names on both ends (e.g. yourcompany.com ↔ theirs.example) stay visible, and of course you and your recipient both still know who you’re talking to.

A third click turns Discrete back off.