1. Secure e-mail r How do you do it? m Need to worry about sniffing, modifying, end- user masquerading, replaying. m If sender and receiver have shared secret keys, then straightforward. m Can use public-key cryptography to distribute keys. m But users do not want to hassle with certificate authority. 1

2. 2 Secure e-mail: PGP r PGP = Pretty Good Privacy r It is availiable free on a variety of platforms. m inventor, Phil Zimmerman, was target of 3-year federal investigation. r Based on well known algorithms. r Not developed or controlled by government or standards organizations

3. 3 Sender Authentication and Message Integrity Alice wants to provide sender authentication message integrity. Alice digitally signs message. sends both message (in the clear) and digital signature. H( ). K A ( ). - + - H(m ) K A (H(m)) - m KAKA - Internet m K A ( ). + KAKA + K A (H(m)) - m H( ). H(m ) compare

4. 4 PGP r Hash: m SHA-1 m 160 bits r Public key cryptography: m RSA r Question: Why digital signatures for authentication? Why not a MAC? m Could use public-key crypto to get a shared key. m But if there are 100 recipients? Need to distribute 100 MAC keys.

5. 5 Confidentiality Alice:  generates random symmetric key, K S.  encrypts message with K S (for efficiency)  also encrypts K S with Bob’s public key.  sends both K S (m) and K B (K S ) to Bob.  Alice wants to send confidential e-mail, m, to Bob. K S ( ). K B ( ). + + - K S (m ) K B (K S ) + m KSKS KSKS KBKB + Internet K S ( ). K B ( ). - KBKB - KSKS m K S (m ) K B (K S ) +

6. 6 Confidentiality Bob:  uses private key to obtain K S  uses K S to decrypt K S (m)  Alice wants to send confidential e-mail, m, to Bob. K S ( ). K B ( ). + + - K S (m ) K B (K S ) + m KSKS KSKS KBKB + Internet K S ( ). K B ( ). - KBKB - KSKS m K S (m ) K B (K S ) +

7. 7 Confidentiality: PGP r Session key: 128 bits r Symmetric encryption: m CAST-128 or IDEA or 3DES r Public key encryption m RSA

8. 8 Secure e-mail: Confidentiality and Authentication Alice wants to provide secrecy, sender authentication, message integrity. Alice uses three keys: her private key, Bob’s public key, newly created symmetric key H( ). K A ( ). - + K A (H(m)) - m KAKA - m K S ( ). K B ( ). + + K B (K S ) + KSKS KBKB + Internet KSKS

9. 9 PGP key rings r Each node has two key rings: m Public/private key pairs owned by that node m Public key of other users r For the keys of other users, for each key track: m user id: e-mail address, name, address, etc. m public key m timestamp: date when key was generated m key ID m key legitimacy m signatures

10. 10 Format of PGP Message KAKA + K A (H(m)) - + r Users may have multiple key pairs m Key ID’s: last 64 bits of public key r Message component r Signature component m Timestamp m Key ID of m Mess digest: m Leading two octets in clear, to verify correct key is being used r Session key component m key ID of K B m Session key: K S

11. 11 PGP Trust r No certificate authority How does Alice obtain Bob’s public key? r Alice physically gets key from Bob r Or from phone conversation r Or gets Bob’s key from Claire, who Alice may or may not trust For a key in your key ring: r Can you trust that key really belongs to the person defined by the user-id? r Can you trust that user-id to vouch for other keys? For each key on ring: r Key legitimacy field indicates how much you trust this key to be valid for the associated user. m Determined by PGP algorithm r Signatures for key. Each signature signed with private key of some user r Also, key ring includes trust values for owners of keys in key ring m Determined by you.

12. 12 Public key management: example r Suppose Alice inserts new public key in key ring. If Alice is owner, trust assigned to Alice is ultimate. r Otherwise, Alice must assign trust value to owner of key: m unknown m untrusted m marginally trusted m completely trusted. r New public key may come with signatures vouching for the key. For each signature, PGP searches ring to see if author of signature is in key ring. r Key legitimacy = legit if one signature completely trusted. Otherwise, determined from formula based on trust of signatures: above threshold, key is considered legit

13. 13 Example legit and trusted legit, not trusted 1)You first assign trust levels to users 2) PGP estimates which keys are legit

14. 14 Example legit and trusted legit, not trusted 1)You first assign trust levels to users 2) PGP estimates which keys are legit

15. 15 PGP summary r PGP provides security at the application layer to a single application r Provides: m Authentication, integrity, confidentiality r Public key verification m Web of trust