Masud Hasan Secue VS Hushmail Project 2

Secure & Hushmail It uses Digital Certificate combined with S/MIME capable clients to digitally sign and encrypt E- mail It uses Digital Certificate combined with OpenPGP capable clients to digitally sign and encrypt E- mail

Two Basic Features – The two basic features of security are privacy (only the intended recipient can read the message) and authentication (the recipient can be assured of the identity of the sender). The technical capabilities for these functions has been known for many years, but they have only been applied to Internet mail recently. – Reality Check: Security experts claim users encrypt only about one in every 50 to 100 of their messages.

Goal of this Project – Learning Hushmail (PGP based secure ) – Compare Hushmail with Secure (S/Mime based) – Which one we should use to secure our ? – Technical difference between those 2 protocols. – Difference in Algorithm, Mechanism used.

Hushmail – How it works As part of enrollment, HushMail generates a public/private key pair for each user. The private key is encrypted with a pass-phrase and, along with the public key, stored on the HushMail server. When a HushMail user wishes to send a private message, a Java applet on the user's PC will request his password. The password is securely hashed, and part of the hash is sent to the HushMail server to validate the user. If the user is authenticated, the HushMail server sends the user's plaintext public key and encrypted private key to the Java applet at the user's machine. The applet symmetrically decrypts the private key and uses it for digital signatures.

Hushmail – How it works messages and attachments are symmetrically encrypted using a unique session key for each message. The session key is encrypted using a HushMail recipient's public key, and included in the message before transmission. When a recipient reads , a Java applet decrypts the encrypted message (and attachments). If the message is digitally signed, the Java applet downloads the sender's public key and uses it to verify the sender.

Features – Enhanced Spam Control – Webmail Updates – File Sharing – IMAP Access – External POP3

OnSite System Requirements Browser: IE 5.0+, Netscape 7.0+ OS: Windows/Linux Java Enabled: MSVM/SUN Hushmail for Outlook requires: Microsoft Office 2000, Microsoft Office XP, or Microsoft Office It also requires that Outlook's “ Collaboration Data Objects ” be installed.

OnSite Installation tips Tips for Getting This Application Working in Internet Explorer: Set Your Security Settings to Medium. The most common problem Internet Explorer users have with this application is that they set the security settings on their browser too high, disabling essential features such as JavaScript. This application recommends a security setting of "Medium".

OnSite Installation Steps Run the Setup executable (I recommend that you set up your address in Outlook prior to installation) Accept License Agreement Complete Installation

OnSite Outlook Configuration Open Microsoft Outlook. Click the Hushmail icon on the Microsoft Outlook toolbar. Click the Add button. Specify whether you would like to digitally sign your outgoing mail.

OnSite Continues…..

OnSite Continues…..

OnSite Secure VS Hushmail Secure uses S/MIME. Hushmail uses OpenPGP. Both the protocols are designed to perform the same task. However, they are not compatible with each other. The key distinguishing factor of these competing protocol is not the algorithm used to encrypt, but the technology used to establish the trust.

OnSite Trust Establishment Hushmail defines trust: Through a “Web of Trust” which places the burden of trust on the end user.It’s a transitive relationship. If A trust B, and B trust C Then A will trust C Secure defines trust: Through a certificate authority (CA ) to establish trust. Every user is issued a certificate that contains his public key and is signed by a CA. Because CA is trusted third party, trust is automatically established among users.

OnSite Continues… Secure follows X.509 standard format for digital signatures which can be only issued by a CA. Open PGP supports not X.509, but rather a digital certificate format developed by PGP Inc. Note: Industry Analyst say big corporations want the extra level of authority a CA brings to the table, as well as the better established X.509 digital certificate. (also include SSL features for browsers)

OnSite Continues… Being said that, Users want encryption and digital certificate to be as simple as hitting the send button to shoot a message over the internet. Hush mail has easier user implementation than Secure . The algorithm used by both the tools are equally strong. None of the Algorithm have been broken mathematically.

OnSite Bottom line…. The bottom line is both forms of trust the S/MIME’s third party CA and OpenPGP’s Web of trust are viable. However, it’s a pity that they don’t “trust” each other enough to work together. Brighter Note: The evolution of both the protocols are now under the guidance of IETF working group.

OnSite Services/ Mechanisms and Algorithm Used Services in a security protocol SignaturesEncryption Hashing RSAAESSHAI

OnSite Conclusion I would consider doing my graduate studies in Computer Security. Thanks for listening and good luck for Final.

OnSite QUESTIONS Only easy ones will be answered! Kidding~~