Principle, utilization and limitations for secure electronic mail systems FACULDADE DE ENGENHARIA DA UNIVERSIDADE DO PORTO Segurança em Sistemas Informáticos 2009/2010 Lindomar Bandeira Rocha

 Inline Encoding ( clearsigning )  Older choice  Good for basic messages  PGP/MIME  More modern choice  Attachment-based 2OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 Occurs directly within the body of the message.  OpenPGP signature at the end of the message.  Encrypted message replaces the original message body completely. 3OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 Inline- encrypted message opened without using OpenPGP program: 4OpenPGP : Principle, utilization and limitations for secure electronic mail systems

DISADVANTAGES :  Non- English caracter sets;  Attachments;  Binary documents;  Mail servers can corrupt clearsigned messages.  Non- English caracter sets;  Attachments;  Binary documents;  Mail servers can corrupt clearsigned messages. ADVANTAGES:  Read by any mail client. 5OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 Attachment-based:  Encrypted message send as attachment;  Signed message and signatures send as attachment;  Attachments are encrypted and attached. 6OpenPGP : Principle, utilization and limitations for secure electronic mail systems

DISADVANTAGES:  Not supported by all mail Clients ADVANTAGES:  Mail servers never modifies attachments;  Mail clients treat attachments as separated objects;  Simple to encrypt different character sets or binary files.  Mail servers never modifies attachments;  Mail clients treat attachments as separated objects;  Simple to encrypt different character sets or binary files. OpenPGP : Principle, utilization and limitations for secure electronic mail systems7

 Proxies  sits between your client and your mail server.  Plug – Ins  integrates with your client. 8OpenPGP : Principle, utilization and limitations for secure electronic mail systems

DISADVANTAGES:  Configure signing, encryption, and decryption in the proxy;  Won’t get an “encrypt and sign” button or menu option;  Have to open the proxy program and say “Encrypt all messages now” or “Encrypt messages to this address.”  Configure signing, encryption, and decryption in the proxy;  Won’t get an “encrypt and sign” button or menu option;  Have to open the proxy program and say “Encrypt all messages now” or “Encrypt messages to this address.” ADVANTAGES:  Works with any mail client; 9OpenPGP : Principle, utilization and limitations for secure electronic mail systems

DISADVANTAGES:  Each mail client plug-in is unique;  Each behaves slightly differently ;  Has a different interface.  Each mail client plug-in is unique;  Each behaves slightly differently ;  Has a different interface. ADVANTAGES:  Provides “sign” and “encrypt” buttons directly within the client;  Is written to look like it’s part of the mail client program.  Provides “sign” and “encrypt” buttons directly within the client;  Is written to look like it’s part of the mail client program. 10OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 When you send someone encrypted , the reader must use the recipient’s private key to read it. However, because you don’t have the recipient’s private key, you can’t read the mail that you sent, even though you created it! 11OpenPGP : Principle, utilization and limitations for secure electronic mail systems

are not protected on your hard drive. Save all your on an encrypted disk partition. Another popular option is to also “Encrypt to self”. 12OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 Expand my Web of Trust  Trace the Web of Trust to that person  Use the key but limit my trust of the sender 13OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 PGP pathfinder  trace the path through the Web of Trust between any two OpenPGP keys  use the keyid for the two keys involved  Based on WOTSAP, Python program designed to trace relashionships between keys 14OpenPGP : Principle, utilization and limitations for secure electronic mail systems

 OpenPGP does not encrypt subject lines in .  messages sent with PGP should have innocuous subjects (or perhaps no subject at all)  Mail client might default to storing unencrypted versions of the OpenPGP s that you send. 15OpenPGP : Principle, utilization and limitations for secure electronic mail systems