ITA, , 7-Secure .pptx 1 Internet Security 1 (IntSi1) Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) 7 Secure

ITA, , 7-Secure .pptx 2 Security Protocols for the OSI Stack Application layerssh, S/MIME, PGP, Kerberos, WSSTransport layerSSL, TLSNetwork layerIPsecData Link layer[PPTP, L2TP], IEEE 802.1X, IEEE 802.1AE, IEEE i (WPA2) Physical layerQuantum CryptographyCommunication layersSecurity protocols

ITA, , 7-Secure .pptx 3 Internet Security 1 (IntSi1) 7.1 S/MIME

ITA, , 7-Secure .pptx 4 MIME – Multipurpose Internet Mail Extension RFC 1521 / RFC boundary1 Content–Type: text/plain; charset=us-ascii Dear Neo, please study the attached Word document. --boundary1 Content–Type: application/msword; name="Matrix.doc" Content–Transfer–Encoding: base64 ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfH 4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbTrfv= --boundary1-- From: To: MIME–Version: 1.0 Content–Type: multipart/mixed; boundary=boundary1

ITA, , 7-Secure .pptx 5 S/MIME – Signed Message Format I RFC 1847 / RFC 2311 / PKCS #7 Content–Type: multipart/signed; protocol="application/pkcs7–signature"; micalg=sha1; boundary=boundary1 --boundary1 Content–Type: text/plain This is a clear-signed message. --boundary1 Content–Type: application/pkcs7–signature; name=smime.p7s Content–Transfer-Encoding: base64 Content–Disposition: attachment; filename=smime.p7s ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfH 4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbTrfv= --boundary1-- MIME entity to be signed

ITA, , 7-Secure .pptx 6 S/MIME – Signed Message comprising Multiple Attachments Content–Type: multipart/signed; protocol="application/pkcs7–signature"; micalg=sha1; boundary=boundary1 --boundary1 Content–Type: multipart/mixed; boundary=boundary2... multipart message with various MIME-types... --boundary1 Content–Type: application/pkcs7–signature; name=smime.p7s Content–Transfer-Encoding: base64 Content–Disposition: attachment; filename=smime.p7s ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfH 4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbTrfv= --boundary1--

ITA, , 7-Secure .pptx 7 PKCS #7 – Public Key Cryptography Standard Cryptographic Message Syntax Standard version digestAlgorithms contentInfo certificates (OPTIONAL) crls (OPTIONAL) signerInfos (SET OF) ASN.1 structure for the SignedData content type ASN.1 structure for the SignerInfo type version issuerAndSerialNumber digestAlgorithm authenticatedAttributes digestEncryptionAlgorithm encryptedDigest unauthenticatedAttributes several signers possible empty field (content carried in separate MIME entity) signature

ITA, , 7-Secure .pptx 8 Signed Message with Multiple Signatures MIME Entity (single-part or multi-part) Digest Algorithm #1 Signature #1 Private Key #1 Digest Algorithm #2 Signature #2 Private Key #2 Digest Algorithm #n Signature #n Private Key #n

ITA, , 7-Secure .pptx 9 Signed Message Microsoft Outlook 2007

ITA, , 7-Secure .pptx 10 S/MIME – Signed Message Format II RFC 2311 / PKCS #7 Content–Type: application/pkcs7–mime; smime–type=signed–data; name=smime.p7m Content–Transfer-Encoding: base64 Content–Disposition: attachment; filename=smime.p7m ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfH 4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbTrfv= MIME content carried within PKCS#7 Signed Data Object This alternative signing format is optionally used by MS Outlook Pro: MIME content is not prone to changes of the transfer encoding enforced by intermediate mail transfer agents. Contra: In order to read the emedded MIME message, the receiver‘s mail client must support S/MIME.

ITA, , 7-Secure .pptx 11 S/MIME – Configuration Options Microsoft Outlook 2007

ITA, , 7-Secure .pptx 12 S/MIME – Encrypted Message Format RFC 2311 / PKCS #7 Content–Type: application/pkcs7–mime; smime–type=enveloped–data; name=smime.p7m Content–Transfer-Encoding: base64 Content–Disposition: attachment; filename=smime.p7m ghyHhHUujhJhjH77n8HHGTrfvbnj756tbB9HG4VQpfyF467GhIGfH 4VQpfyF467GhIGfHfYT6jH77n8HHGghyHhHUujhJh756tbTrfv= version recipientInfos encryptedContentInfo ASN.1 structure for the EnvelopedData content type several recipients possible (encrypted symmetric key ) contentType contentEncryptionAlgorithm encryptedContent encrypted MIME entity (single-part or multi-part)

ITA, , 7-Secure .pptx 13 Encrypted Message with Multiple Recipients Envelope using Symmetric Encryption MIME Entity (single-part or multi-part) Random Key Symmetric Encryption Algorithm Encrypted MIME Entity Encrypted Key #n Public Key #n Encrypted Key #2 Public Key #2 Encrypted Key #1 Public Key #1

ITA, , 7-Secure .pptx 14 Encrypted Message Microsoft Outlook 2007

ITA, , 7-Secure .pptx 15 Signed and Encrypted Messages Mozilla Thunderbird

ITA, , 7-Secure .pptx 16 S/MIME – Signed and Encrypted Messages I Signing before Encryption MIME entity to be encrypted Signature(s) not visible before decryption (Anonymity) Content–Type: application/pkcs7–mime; smime–type=signed–data;... signedData SignedData ::= {... contentInfo } MIME entity to be signed Content–Type: application/pkcs7–mime; smime–type=enveloped–data;... envelopedData EnvelopedData ::= {... encryptedContentInfo } encrypted MIME entity

ITA, , 7-Secure .pptx 17 S/MIME – Signed and Encrypted Messages II Encryption before Signing MIME entity to be signed Signature(s) can be checked before decryption (Trust) Content–Type: application/pkcs7–mime; smime–type=signed–data;... signedData SignedData ::= {... contentInfo } Content – Type: application/pkcs7–mime; smime–type=enveloped–data;... envelopedData EnvelopedData ::= {... encryptedContentInfo } encrypted MIME entity MIME entity to be signed

ITA, , 7-Secure .pptx 18 Signing before Encryption Microsoft Outlook 2007

ITA, , 7-Secure .pptx 19 S/MIME – Managing Certificates Mozilla Thunderbird

ITA, , 7-Secure .pptx 20 S/MIME – Certificates (own and other people‘s) Mozilla Thunderbird

ITA, , 7-Secure .pptx 21 S/MIME – Certification Authorities Mozilla Thunderbird

ITA, , 7-Secure .pptx 22 S/MIME – Account Settings Mozilla Thunderbird

ITA, , 7-Secure .pptx 23 S/MIME Summary Antje Kool CA #2 AntjeBodo Sign Dear Bodo, … Antje Sign with private key Verify with public key Kool CA #0 AntjeBodo Encrypt Antje Kool CA #2 Dear Antje, … Bodo Decrypt with private key Encrypt with public key Bob Kool CA #3