After email, Tuta has made its calendar quantum-safe

Update: On October 2, 2024, Tuta confirmed to TechRadar that Apple has fixed the issue and the Tuta Calendar app is now available on iOS, too. The secure email provider still asks for a password to delete an account.

One of the best secure email providers on the market has just taken a step further into its post-quantum transition by releasing a new quantum-safe and encrypted Calendar app for mobile.

After becoming the first quantum-resistant email service last March, Tuta (formerly known as Tutanota) also claims to be the first to offer these protections on a Calendar. The company is currently working on an encrypted file storage solution, Tuta Drive, that will also be quantum-safe.

While rolling out its calendar feature back in 2019, Tuta Calendar is now finally available as a standalone application for mobile. The provider planned to release it for both Android and iOS, but the team told TechRadar that Apple had halted the launch at the time of writing (the issue would be fixed a day after the launch, on October 2, 2024).

Tuta's post-quantum commitment

"Privacy is not a zero-sum game. When your privacy increases, so does mine," said Arne Möhle, CEO at Tuta. "By building tools that improve the security of one person, we are increasing the overall privacy and security of everyone they communicate with."

Such a commitment to privacy is at the core of Tuta's mission of offering protection against new cybersecurity threats, too.

The countdown until current encryption becomes obsolete is already underway. Quantum computers – which can process computations that today's machines can't handle within minutes – are evolving quickly and experts believe a larger implementation is just a few years away. Cybercriminals know this and are already crafting "store now, decrypt later (SNDL)" attacks to take advantage of the quantum transition.

"That’s why going quantum-safe was so important to us at Tuta: we promise security to our users, so we have to deliver on that promise," Möhle told me, adding that implementing quantum-safe cryptography should be a priority for everyone in the industry.

Similar to its email client, the Calendar uses TutaCrypt, the encryption protocol the company developed to exchange messages using quantum-safe encryption. While you can find more technical details here, the main takeaway is that the team implemented a hybrid approach combining post-quantum and traditional encryption methods.

Despite TutaCrypt originally using the CRYSTALS-Kyber algorithm when launched back in March, Möhle told me this is now based on the newly released NIST algorithm standards. "The way we implemented it, we are able to quickly adapt the algorithms whenever needed," he added. 

Tuta's new Calendar app

Tuta's Calendar uses end-to-end encryption and a zero-knowledge architecture to ensure your schedule stays private to you. Besides quantum-safe encryption, the app also comes with a wealth of new features.

For instance, events from third-party calendars will automatically sync and update in Tuta Calendar. This is handy if you need to subscribe to external calendars like those from a workplace, community group, or school.

You can now import .ics calendar data on Android and (hopefully soon) iOS as well. Previously, this was only possible on desktops.

This new release also includes new push notification reminders. The provider promises to handle these locally on your devices so that not even Tuta servers will know about your meetings or any other information.

Tuta Calendar comes with more than just new functionalities, though. The new app changes its look thanks to a new blue icon and matching themes in light and dark mode.

As mentioned earlier, Tuta intended to release its new Calendar app for both Android and iOS devices today (October 1, 2024). At the time of writing, however, Apple halted the launch due to technical issues. 

The problem here lies in the fact that Tuta Calendar asks for a password to delete an account. As Möhle explains, the application was built in this way for security reasons to ensure that no one who gets hold of your phone can maliciously delete your Tuta account.

"While Apple continues to ask us to change this mechanism, we do not want to do this - for obvious security reasons," he told me. "This could be a misunderstanding, and we are trying to solve the issue with Apple."