Communication through e-mail has become a standard in daily business. Even business critical documents are distributed via e-mail. Therefore legislation requires businesses to preserve their e-mails for ten or more years like conventional documents and if required, the data has to be recovered in an acceptable time. Besides the legal requirement there is also an operational need for an e-mail archive system as the flood of e-mails and attachments tends to exceed the storage capacity of e-mail systems.

There are several archiving systems available on the market which all provide some sort of automatic retaining, together with useful methods and tools for retrieval. They also take care of the long-term tamperproof storage by using write-only media. A non-trivial problem arises when archiving encrypted or signed messages. In such cases a proper management of keys and certificates becomes essential, namely for the ability to prove business evidence of archived e-mail documents.

The goal of this report is to make IT managers of small to medium-size businesses aware of the problems around e-mail archiving and to provide an overview of solution approaches. We give a substantial introduction to the practical aspects of using cryptographic methods for encryption and digital signatures, focusing on usability aspects.

We examine a set of available e-mail archiving products. Most of them cover a common set of functionality, but they are not yet designed to handle cryptographic elements. It appears as if the importance of the combination is not yet recognized. This reflects the fact that cryptographic methods are still not widely used in small to medium-size companies.

Nevertheless this guide gives a comprehensive presentation of the topic, including useful hints on how to implement e-mail archiving with forethoughts towards using cryptographic methods and tools. We show that clean, effective solutions are also affordable.