1. Principle, utilization and limitations for secure electronic mail systems FACULDADE DE ENGENHARIA DA UNIVERSIDADE DO PORTO Segurança em Sistemas Informáticos 2009/2010 Lindomar Bandeira Rocha

2.  Inline Encoding ( clearsigning )  Older choice  Good for basic email messages  PGP/MIME  More modern choice  Attachment-based 2OpenPGP : Principle, utilization and limitations for secure electronic mail systems

3.  Occurs directly within the body of the email message.  OpenPGP signature at the end of the message.  Encrypted message replaces the original message body completely. 3OpenPGP : Principle, utilization and limitations for secure electronic mail systems

4.  Inline- encrypted message opened without using OpenPGP program: 4OpenPGP : Principle, utilization and limitations for secure electronic mail systems

5. DISADVANTAGES :  Non- English caracter sets;  Attachments;  Binary documents;  Mail servers can corrupt clearsigned messages.  Non- English caracter sets;  Attachments;  Binary documents;  Mail servers can corrupt clearsigned messages. ADVANTAGES:  Read by any mail client. 5OpenPGP : Principle, utilization and limitations for secure electronic mail systems

6.  Attachment-based:  Encrypted message send as attachment;  Signed message and signatures send as attachment;  Attachments are encrypted and attached. 6OpenPGP : Principle, utilization and limitations for secure electronic mail systems

7. DISADVANTAGES:  Not supported by all mail Clients ADVANTAGES:  Mail servers never modifies attachments;  Mail clients treat attachments as separated objects;  Simple to encrypt different character sets or binary files.  Mail servers never modifies attachments;  Mail clients treat attachments as separated objects;  Simple to encrypt different character sets or binary files. OpenPGP : Principle, utilization and limitations for secure electronic mail systems7

8.  Proxies  sits between your email client and your mail server.  Plug – Ins  integrates with your email client. 8OpenPGP : Principle, utilization and limitations for secure electronic mail systems

9. DISADVANTAGES:  Configure signing, encryption, and decryption in the proxy;  Won’t get an “encrypt and sign” button or menu option;  Have to open the proxy program and say “Encrypt all messages now” or “Encrypt messages to this email address.”  Configure signing, encryption, and decryption in the proxy;  Won’t get an “encrypt and sign” button or menu option;  Have to open the proxy program and say “Encrypt all messages now” or “Encrypt messages to this email address.” ADVANTAGES:  Works with any mail client; 9OpenPGP : Principle, utilization and limitations for secure electronic mail systems

10. DISADVANTAGES:  Each mail client plug-in is unique;  Each behaves slightly differently ;  Has a different interface.  Each mail client plug-in is unique;  Each behaves slightly differently ;  Has a different interface. ADVANTAGES:  Provides “sign” and “encrypt” buttons directly within the client;  Is written to look like it’s part of the mail client program.  Provides “sign” and “encrypt” buttons directly within the client;  Is written to look like it’s part of the mail client program. 10OpenPGP : Principle, utilization and limitations for secure electronic mail systems

11.  When you send someone encrypted email, the reader must use the recipient’s private key to read it. However, because you don’t have the recipient’s private key, you can’t read the mail that you sent, even though you created it! 11OpenPGP : Principle, utilization and limitations for secure electronic mail systems

12. Email are not protected on your hard drive. Save all your Email on an encrypted disk partition. Another popular option is to also “Encrypt to self”. 12OpenPGP : Principle, utilization and limitations for secure electronic mail systems

13.  Expand my Web of Trust  Trace the Web of Trust to that person  Use the key but limit my trust of the sender 13OpenPGP : Principle, utilization and limitations for secure electronic mail systems

14.  PGP pathfinder  trace the path through the Web of Trust between any two OpenPGP keys  use the keyid for the two keys involved  Based on WOTSAP, Python program designed to trace relashionships between keys 14OpenPGP : Principle, utilization and limitations for secure electronic mail systems

15.  OpenPGP does not encrypt subject lines in email.  Email messages sent with PGP should have innocuous subjects (or perhaps no subject at all)  Mail client might default to storing unencrypted versions of the OpenPGP emails that you send. 15OpenPGP : Principle, utilization and limitations for secure electronic mail systems