1. 1 Electronic mail security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49

2. 2 Outline  Pretty good privacy  S/MIME

3. 3 Pretty Good Privacy  Philip R. Zimmerman is the creator of PGP.  PGP provides a confidentiality and authentication service that can be used for electronic mail and file storage applications.

4. 4 Why Is PGP Popular?  It is available free on a variety of platforms.  Based on well known algorithms.  Wide range of applicability  Not developed or controlled by governmental or standards organizations

5. 5 Operational Description  Consist of five services:  Authentication  Confidentiality  Compression  E-mail compatibility  Segmentation

6. 6

7. 7 Compression  PGP compresses the message after applying the signature but before encryption  The placement of the compression algorithm is critical.  The compression algorithm used is ZIP (described in appendix 5A)

8. 8 E-mail Compatibility  The scheme used is radix-64 conversion (see appendix 5B).  The use of radix-64 expands the message by 33%.

9. 9 Segmentation and Reassembly  Often restricted to a maximum message length of 50,000 octets.  Longer messages must be broken up into segments.  PGP automatically subdivides a message that is to large.  The receiver strip of all e-mail headers and reassemble the block.

10. 10 Summary of PGP Services

11. 11

12. 12 Format of PGP Message

13. 13

14. 14

15. 15

16. 16 Obtaining trust  How can we obtain trust in the the other parties public key?  Certificate  Getting the key personally  PGP tries to give trust in a new way  Web of trust

17. 17 The Use of Trust  The user maintains a data structure with certified keys together with the following fields  Owner trust field, assigned by user  Signature trust field, cached copies of respective owner trust fields  Key legitimacy field, calculated by PGP  Trust for each key us calculated as weighted sum of trust in signatures for this key

18. 18

19. 19 Revoking Public Keys  The owner issue a key revocation certificate.  Normal signature certificate with a revote indicator.  Corresponding private key is used to sign the certificate.

20. 20 S/MIME  Secure/Multipurpose Internet Mail Extension  S/MIME will probably emerge as the industry standard.  PGP for personal e-mail security

21. 21 Simple Mail Transfer Protocol (SMTP, RFC 822)  SMTP Limitations - Can not transmit, or has a problem with:  executable files, or other binary files (jpeg image)  “national language” characters (non-ASCII)  messages over a certain size  ASCII to EBCDIC translation problems  lines longer than a certain length (72 to 254 characters)

22. 22 Header fields in MIME  MIME-Version: Must be “1.0” -> RFC 2045, RFC 2046  Content-Type: More types being added by developers (application/word)  Content-Transfer-Encoding: How message has been encoded (radix-64) Optional fields:  Content-ID: Unique identifying character string.  Content Description: Needed when content is not readable text (e.g.,mpeg)

23. 23 Header fields in MIME, Content-Type

24. 24 Header fields in MIME, Content-Transfer-Encoding

25. 25 MIME Example Return-Path: Received: from webt.msi.vxu.se (localhost [127.0.0.1]) by babbage (Cyrus v2.1.16) with LMTP; Wed, 13 Feb 2008 09:22:44 +0100 X-Sieve: CMU Sieve 2.2 Received: from mailinone.vxu.se (mailinone.vxu.se [194.47.65.80]) by webt.msi.vxu.se (8.12.10/8.12.10) with ESMTP id m1D8MgvG008161 for ; Wed, 13 Feb 2008 09:22:43 +0100 (MET) Received: from [194.47.95.160] by mailinone.vxu.se (Sun Java System Messaging Server 6.2-8.01 (built Nov 27 2006)) with ESMTPSA id for Ola.Flygt@tcp_msi-daemon (ORCPT Ola.Flygt@msi.vxu.se); Wed, 13 Feb 2008 09:22:41 +0100 (MET) Date: Wed, 13 Feb 2008 09:22:39 +0100 From: Ola Flygt Subject: A simple MIME example To: Ola Flygt Message-id: MIME-version: 1.0 (Apple Message framework v753) X-Mailer: Apple Mail (2.753) Content-type: text/plain; charset=US-ASCII; format=flowed Content-transfer-encoding: 7bit X-Spam-Debug: msi.vxu.se 0 X-Spam-Report: msi.vxu.se 0 () X-Spam-Score: 0 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.49 on 194.47.94.71 This is a simple text message.

26. 26 MIME Example 2 Return-Path: Received: from webt.msi.vxu.se (localhost [127.0.0.1]) by babbage (Cyrus v2.1.16) with LMTP; Wed, 13 Feb 2008 09:24:08 +0100 X-Sieve: CMU Sieve 2.2 Received: from mailinone.vxu.se (mailinone.vxu.se [194.47.65.80]) by webt.msi.vxu.se (8.12.10/8.12.10) with ESMTP id m1D8O7vG009405 for ; Wed, 13 Feb 2008 09:24:07 +0100 (MET) Received: from [194.47.95.160] by mailinone.vxu.se (Sun Java System Messaging Server 6.2-8.01 (built Nov 27 2006)) with ESMTPSA id for Ola.Flygt@tcp_msi-daemon (ORCPT Ola.Flygt@msi.vxu.se); Wed, 13 Feb 2008 09:24:07 +0100 (MET) Date: Wed, 13 Feb 2008 09:24:05 +0100 From: Ola Flygt Subject: A HTML example To: Ola Flygt Message-id: MIME-version: 1.0 X-Mailer: Apple Mail (2.753) Content-type: multipart/alternative; boundary=Apple-Mail-46--901936981 X-Spam-Debug: msi.vxu.se 0 X-Spam-Report: msi.vxu.se 0 () X-Spam-Score: 0 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.49 on 194.47.94.71 This is a mail using HTML encoding of the text.

27. 27 MIME Example 3 Return-Path: Received: from webt.msi.vxu.se (localhost [127.0.0.1]) by babbage (Cyrus v2.1.16) with LMTP; Wed, 13 Feb 2008 09:30:16 +0100 X-Sieve: CMU Sieve 2.2 Received: from mailinone.vxu.se (mailinone.vxu.se [194.47.65.80]) by webt.msi.vxu.se (8.12.10/8.12.10) with ESMTP id m1D8UFvG013858 for ; Wed, 13 Feb 2008 09:30:16 +0100 (MET) Received: from [194.47.95.160] by mailinone.vxu.se (Sun Java System Messaging Server 6.2-8.01 (built Nov 27 2006)) with ESMTPSA id for Ola.Flygt@tcp_msi-daemon (ORCPT Ola.Flygt@msi.vxu.se); Wed, 13 Feb 2008 09:30:15 +0100 (MET) Date: Wed, 13 Feb 2008 09:30:14 +0100 From: Ola Flygt Subject: An image example To: Ola Flygt Message-id: MIME-version: 1.0 (Apple Message framework v753) X-Mailer: Apple Mail (2.753) Content-type: multipart/mixed; boundary=Apple-Mail-47--901568932 X-Spam-Debug: msi.vxu.se 0 X-Spam-Report: msi.vxu.se 0 () X-Spam-Score: 0 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.49 on 194.47.94.71 This is an example including a small image. Attachment converted: HD:pastedGraphic.tiff (TIFF/«IC») (00280A8B)

28. 28 S/MIME Functions  Enveloped Data: Encrypted content and encrypted session keys for recipients.  Signed Data: Message Digest encrypted with private key of “signer.”  Clear-Signed Data: Signed but not encrypted.  Signed and Enveloped Data: Various orderings for encrypting and signing.

29. 29 Algorithms Used  Message Digesting: SHA-1 and MD5  Digital Signatures: DSS  Secret-Key Encryption: Triple-DES, RC2/40 (exportable)  Public-Private Key Encryption: RSA with key sizes of 512 and 1024 bits, and Diffie- Hellman (for session keys).

30. 30 User Agent Role  S/MIME uses Public-Key Certificates - X.509 version 3 signed by Certification Authority  Functions:  Key Generation - Diffie-Hellman, DSS, and RSA key-pairs.  Registration - Public keys must be registered with X.509 CA.  Certificate Storage - Local (as in browser application) for different services.  Signed and Enveloped Data - Various orderings for encrypting and signing.

31. 31 User Agent Role  Example: Verisign (www.verisign.com)  Class-1: Buyer’s email address confirmed by emailing vital info.  Class-2: Postal address is confirmed as well, and data checked against directories.  Class-3: Buyer must appear in person, or send notarized documents.