DIDComm messaging vs Email messaging

DIDComm messaging is a decentralized messaging protocol that provides high levels of security and privacy using decentralized identifiers known as DIDs. Unlike email messaging, which relies on centralized servers (e.g., Google, Yahoo) to transmit messages, DIDComm operates in a completely decentralized manner. There is no central authority or server controlling your identity, as is the case with email messaging, where email addresses and passwords are stored and managed by centralized servers. With DIDComm, only the individual or organization owning a DID can manage and decide what information to share about its identity.

To understand the differences between DIDComm and email messaging, we need to look at the architecture of each approach. DIDComm is designed for a self-sovereign world where users have control over their identities, while email messaging is built around centralized communication systems. Here’s a deeper dive into these differences:

Key Differences Between DIDComm and Email Messaging

1. Security

• Email Messaging: By default, email messages are sent in an unsecured (unencrypted) form, exposing message content to potential interception by malicious actors. Encryption can be added using protocols like PGP or S/MIME, but these setups are often complex and not widely adopted by non-technical users.
• DIDComm Messaging: Messages are encrypted throughout the entire communication flow by default, ensuring that only the intended recipient can decrypt and read the message. This end-to-end encryption is integral to the DIDComm protocol, providing a higher level of security from the start.

2. Privacy

• Email Messaging: Even when encrypted, email communication reveals metadata such as sender and recipient addresses, server information, and timestamps in the email headers. This can potentially compromise privacy, as it exposes information about the communication’s participants and routing.
• DIDComm Messaging: Supports selective disclosure, where users can choose to share only the necessary information rather than full data. The use of DIDs enables pseudonymous communication, providing stronger privacy protection by limiting metadata exposure.

3. Decentralization

• Email Messaging: Depends on centralized service providers who manage email accounts and handle message delivery. Providers can filter, block, or monitor messages, and governments or corporations can exert control over these providers to censor or surveil communications, limiting the system’s resistance to censorship.
• DIDComm Messaging: Operates in a decentralized manner, with no reliance on central authorities or service providers. Messages are exchanged directly between peers and can be stored in decentralized storage solutions or transmitted over various transport protocols. This decentralized nature makes DIDComm resistant to censorship, as there is no central authority that can block or filter messages. Users can easily switch communication channels without being locked into a specific service.

Comparison to S/MIME

It might seem that DIDComm is not so different from S/MIME, as both offer message security. However, there are significant differences:

1. Trust Model

• DIDComm: Uses decentralized trust anchored in DIDs and Verifiable Credentials. Trust is established through decentralized identity frameworks, allowing users to control their public/private key pairs independently without relying on a centralized Certificate Authority (CA).
• S/MIME: Relies on a hierarchical trust model based on CAs, which issue and manage digital certificates. If a CA is compromised or a certificate is revoked, the trust in the entire system can be affected. Users must trust that the CAs are correctly verifying identities and securely managing certificates.

2. Privacy

• DIDComm: Supports pseudonymous communication, allowing users to control the amount of information disclosed about their identity. DIDComm also enables selective disclosure, where only the necessary information is shared in a given interaction. Additionally, DIDComm provides stronger privacy guarantees by limiting metadata exposure, as the protocol does not rely on centralized email servers or intermediaries.
• S/MIME: While S/MIME encrypts the content of the email, it still exposes metadata such as the sender and recipient email addresses, timestamps, and subject lines in the email headers. These headers are not encrypted and can potentially be accessed by intermediaries or service providers, compromising privacy. Furthermore, S/MIME certificates often contain real-world identity information, which can inadvertently reveal personal details during communications.

Use Cases

• DIDComm Messaging: Suited for scenarios requiring secure, privacy-respecting, and decentralized communication, such as digital identity verification, blockchain-based applications, and confidential business communications.
• Email Messaging: More appropriate for everyday communication, notifications, and formal correspondences where strict decentralization and privacy are less critical. It is a well-established method for public-facing communication and standard business use.

Conclusion
DIDComm and email serve different needs in the realm of messaging.

DIDComm is built for a decentralized, self-sovereign identity world, providing robust security and privacy controls with no reliance on central authorities. In contrast, email is a more traditional, centralized approach to communication that offers convenience at the cost of potential security and privacy limitations.

Keen to explore how adorsys can guide your company into this world? Reach out to us here, our team will be delighted to discuss tailored solutions for your organisation.

Written by Christian Yemele (Software Engineer at adorsys).