Privacy by Design - A look back and a look forward

From X.400 to SMTP: The Story of a Simpler Takeover

In the early days of digital communication, there were two competing visions for email. One was the complex, feature-rich, and highly structured X.400 standard, championed by the International Telecommunication Union (ITU). The other was the simpler, more flexible Simple Mail Transfer Protocol (SMTP), which emerged from the internet’s open and collaborative development. Ultimately, SMTP and complementary protocols like PGP (Pretty Good Privacy) prevailed due to their simplicity, adaptability, and the decentralized nature of the internet.

Why X.400 Lost the Race

1. Complexity and Cost: X.400 was designed for a world of large, interconnected corporate and government networks. It was incredibly complex, with a rigid, hierarchical addressing system and a wide array of mandatory features. This complexity made it difficult and expensive to implement, especially for smaller organizations and individual users. The barriers to entry were high.

2. The Rise of TCP/IP: X.400 was part of the OSI (Open Systems Interconnection) model, a competing network architecture to the more pragmatic and widely adopted TCP/IP. As the internet, built on TCP/IP, became the dominant global network, a simpler email protocol that could run on it was needed. SMTP was a perfect fit, requiring far less overhead and integration effort.

3. Simplicity Wins: SMTP’s biggest advantage was its name: “Simple.” It focused on a single task—transferring a message from one server to another. The addressing scheme was straightforward (user@domain), and the protocol itself was easy to implement and debug. The features that X.400 had, like rich-text formatting and non-repudiation, were either not as critical for the early internet or were addressed by later, separate protocols, like MIME and PGP.

A Glimpse into an Alternate Digital World

If X.400 had prevailed, our digital world would likely look very different. The internet’s open, collaborative, and decentralized ethos might never have fully taken hold.

• A Centralized Internet: Instead of the open, permissionless network we know today, the internet might have evolved into a collection of walled-off, hierarchical corporate and government systems. Communication would have been more difficult across these domains, and the free flow of information that led to the web’s explosive growth might have been stifled.

• No Gmail, No Hotmail, No Free Mail: The high cost and complexity of X.400 would have made free email providers nearly impossible to launch. Instead of millions of independent email addresses, we would likely have had to get our addresses from our employers, universities, or governments, just as we get a phone number from a telecom provider. The entire concept of personal, free email would have been non-existent.

• A Different Social Media Landscape: Social media platforms rely on the free and easy exchange of information. Without a simple, globally interoperable messaging protocol, the ability for people to connect and share across different networks would have been severely limited. Facebook, X, and other platforms might not have been possible in their current form.

The Advantages We Could Have Had

While X.400’s complexity ultimately led to its downfall, it was not without its merits. Had it prevailed, some aspects of the digital world would have been fundamentally different, and in some ways, more advanced from the start.

• Built-in Identity and Trust: One of the key advantages of X.400 was its robust, identity-based addressing. The address itself contained a verifiable, hierarchical structure tied to an organization or administrative domain. This meant that messages inherently had a higher degree of non-repudiation and proof of identity built into the protocol. When you received a message, you could be more certain of its origin. This is a problem SMTP still struggles with today, as evidenced by the prevalence of email spoofing, spam, and phishing.

• Integrated Security Features: X.400 had security built into the standard from the ground up, including secure messaging, authentication, and directory services. This was a core part of the protocol, not an add-on. In contrast, for SMTP, security and privacy solutions like PGP and S/MIME were developed as separate, optional layers, leading to inconsistent adoption and a more fragmented user experience.

A Modern Rebalancing: Privacy by Design and SD-JWT

Interestingly, while SMTP’s simplicity and openness won the day, the internet is now trying to solve the very problems that X.400 addressed. We are now seeing a move towards a rebalancing, where we try to achieve the benefits of X.400’s secure, verifiable communication without its a stifling complexity.

This is where concepts like SD-JWT and the EU Digital Identity (EUDI) Wallet come into play. They represent a new philosophy of privacy by design. They take the core idea of a verifiable, cryptographically secure credential (like an X.400 certificate) and combine it with the flexibility and user control that defines the modern internet.

In this new paradigm, we are not going back to a rigid, top-down system. Instead, we are building a more secure and trustworthy foundation by:

1. Granting the User Control: Unlike X.400, where the system owned your address, the EUDI Wallet gives the individual control of their own credentials.
2. Using Selective Disclosure: The SD-JWT’s “selective disclosure” capability directly addresses the privacy shortcomings of full-disclosure protocols, ensuring that only the necessary information is ever shared.
3. Relying on Cryptographic Proofs: Instead of trusting a hierarchical directory, modern systems use cryptographic proofs to verify identity and data integrity, aligning with the decentralized trust model of the internet.

In a way, the digital world is now learning from the mistakes and successes of both X.400 and SMTP. We are taking the best ideas from a complex, secure, and identity-driven standard and combining them with the simplicity, flexibility, and user-centric philosophy that powered the internet’s growth. The result is a new generation of digital identity that could finally deliver on the promise of both a free and secure digital world.