# Tutanota upgrades encryption from AES-128 to 256! **URL:** https://discuss.privacyguides.net/t/tutanota-upgrades-encryption-from-aes-128-to-256/16143 **Category:** General **Tags:** article **Created:** 2024-01-11T19:49:07Z **Posts:** 16 ## Post 1 by @anon97654407 — 2024-01-11T19:49:07Z > **[AES 256 Is Now Securing All Your Encrypted Tuta Emails | Tuta](https://tuta.com/blog/aes-256-encryption)** > > We have updated to AES 256 encryption by default, the next step towards full post-quantum encryption! > The new year brings a great update to Tuta Mail: We’ve now switched on AES 256 encryption by default for all new emails sent via Tuta. This is great security improvement and the next step towards quantum-safe encryption. > > In addition, we have now enabled Argon2 as the standard password derivation function for all new accounts or when your change your password. Argon2 is one of the best modern key derivation process, which makes sure that your encryption keys that are derived from your password in the Tuta client are secure. > > You can read more on [Agron2 and why it’s best for security here](https://tuta.com/blog/best-encryption-with-kdf). > > On our road to achieve [quantum security](https://tuta.com/blog/pqdrive-project) we are now updating our asymmetric cryptography (currently RSA 2048), in a next step we are focusing on rotating the existing encryption keys and key verification. > > With this release we are also rolling out support for a new quantum-safe hybrid encryption protocol that we designed. We will describe this in detail in a future blog post. This protocol is not yet actively used by clients, but we will enable it for new accounts as one of the next steps. Afterwards we will work on encryption key rotation so that our existing customers can also reach quantum-safety. Once rolled out, it will be possible to replace existing AES 128 and keys with new AES 256 keys. The same will be possible with the asymmetric RSA 2048 keys which will be replaced with both X25519 and Kyber-1024 turning the protocol into a hybrid (classical and quantum-safe) public key protocol. --- ## Post 2 by @anon64393658 — 2024-01-13T04:16:35Z This is a great update! Hopefully Proton follows suit. Having a few different privacy focused email providers competing against each other is great news for privacy focused consumers. --- ## Post 3 by @jonah — 2024-01-13T04:48:25Z > **[AES 256 Is Now Securing All Your Encrypted Tuta Emails!](https://discuss.techlore.tech/t/aes-256-is-now-securing-all-your-encrypted-tuta-emails/6726/4)** > > Proton does use AES-256 according to this 2016 whitepaper: Proton is also an author of this PGP spec to add CRYSTALS-Kyber and CRYSTALS-Dilithium in conjunction with established ECC, which is the same approach as Signal and now Tuta are taking... --- ## Post 4 by @anon64393658 — 2024-01-13T05:01:14Z Wow I don’t know how I missed that update, thank you for the correction @jonah --- ## Post 5 by @abstract — 2024-01-13T10:58:50Z Webassembly means you have to disable JIT in Vanadium for tuta domains in order to access the web interface. --- ## Post 6 by @hxn — 2024-01-13T13:32:43Z \*enable @abstract I’m curious how much of a threat vector this presents though. --- ## Post 7 by @wojciechxtx — 2024-01-13T13:46:21Z > [@hxn](#): > > I’m curious how much of a threat vector this presents though. what threat are you talking about? --- ## Post 8 by @hxn — 2024-01-13T14:11:31Z > what threat are you talking about? Enabling WebAssembly (Javascript JIT). It allows you to compile JS to native code. As Tuta explains, it allows them to run code on your device using any programming language. It improves performance but sacrifices security. It’s why it’s disabled by default in Vanadium. I don’t know how bad it is to enable it. --- ## Post 9 by @abstract — 2024-01-16T09:33:35Z You enable it per-site, not for the whole browser… --- ## Post 10 by @hxn — 2024-06-10T03:26:21Z No, you enable it for the whole browser with Vanadium. --- ## Post 11 by @wojciechxtx — 2024-06-10T10:05:36Z > [@hxn](#): > > No, you enable it for the whole browser with Vanadium. So, IIUYC, `Vanadium is not so privacy focused as they claim to be. --- ## Post 12 by @hxn — 2024-06-10T10:41:33Z I’d be careful with making that case, the developers behind GrapheneOS aren’t dummies. --- ## Post 13 by @anon48875053 — 2024-06-10T11:00:50Z JavaScript JIT on Vanadium is per-site, if that’s what you’re talking about. --- ## Post 14 by @wojciechxtx — 2024-06-10T18:20:11Z @hxn How it corresponds to what I’ve claimed? --- ## Post 15 by @Dkama — 2024-06-12T13:52:01Z This is wrong 1. Settings \> Site Settings \> JavaScript JIT – - enable/disable for the whole browser 2. permissions icon in the address bar \> Permissions \> JavaScript JIT — re-enable it on a per-site basis (or manually via “Add site exception” in the settings) --- ## Post 16 by @hxn — 2024-06-14T05:30:03Z You said I was wrong but you proved me correct. However I did not realise you could _also_ adjust this setting on a per site basis (I never even noticed you could click on permissions icon).