# WSEmail: A Retrospective on a System for Secure Internet Messaging Based on Web Services

## TL;DR

WSEmail revisits a decade-old web service-based email system, demonstrating its security, extensibility, and flexibility through formal proofs and practical use cases, highlighting its potential as an alternative to modern messaging systems.

## Contribution

The paper provides a retrospective analysis of WSEmail, showcasing its architecture, security proofs, and performance, emphasizing its innovative extensibility features in secure internet messaging.

## Key findings

- WSEmail's architecture enables rich extensions without protocol changes.
- Formal security proofs validate core protocols like on-demand attachments.
- Prototype experiments show about 0.25 seconds latency per transaction.

## Abstract

Web services offer an opportunity to redesign a variety of older systems to exploit the advantages of a flexible, extensible, secure set of standards. In this work we revisit WSEmail, a system proposed over ten years ago to improve email by redesigning it as a family of web services. WSEmail offers an alternative vision of how instant messaging and email services could have evolved, offering security, extensibility, and openness in a distributed environment instead of the hardened walled gardens that today's rich messaging systems have become. WSEmail's architecture, especially its automatic plug-in download feature allows for rich extensions without changing the base protocol or libraries. We demonstrate WSEmail's flexibility using three business use cases: secure channel instant messaging, business workflows with routed forms, and on-demand attachments. Since increased flexibility often mitigates against security and performance, we designed WSEmail with security in mind and formally proved the security of one of its core protocols (on-demand attachments) using the TulaFale and ProVerif automated proof tools. We provide performance measurements for WSEmail functions in a prototype we implemented using .NET. Our experiments show a latency of about a quarter of a second per transaction under load.