Security Analysis on End-to-End Encryption of Zoom Mail

Zoom Mail, an email service provided by Zoom Video Communications, features a proprietary end-to-end encryption (E2EE) scheme, which is detailed in a whitepaper available on GitHub. To date, there has been no detailed discussion or third-party evaluation of the security of the E2EE implementation in Zoom Mail. In this paper, we conduct a comprehensive security analysis of Zoom Mail's E2EE. Specifically, we establishes four types of adversary models: insiders, outsiders, To/CC (carbon copy) members, and BCC (blind carbon copy) member. We focus on three security goals: confidentiality, integrity, and authenticity. Based on these adversary models and security goals, we present the results of security evaluation of Zoom Mail's E2EE for the first time.