![Chapter 5 Electronic mail security Henric Johnson Blekinge Institute of Technology, Sweden http://www.its.bth.se/staff/hjo/ [email_address]](https://image.slidesharecdn.com/chapter-ns5-24272/85/E-mail-Security-in-Network-Security-NS5-1-320.jpg)
E-mail Security in Network Security NS5
- 1. Chapter 5 Electronic mail security Henric Johnson Blekinge Institute of Technology, Sweden http://www.its.bth.se/staff/hjo/ [email_address]
- 2. Outline Pretty good privacy S/MIME Recommended web sites
- 3. Pretty Good Privacy Philip R. Zimmerman is the creator of PGP. PGP provides a confidentiality and authentication service that can be used for electronic mail and file storage applications.
- 4. Why Is PGP Popular? It is availiable free on a variety of platforms. Based on well know n algorithms . Wide range of applicability Not developed or controlled by governmental or standards organizations
- 5. Operational Description Consist of five services: Authentication Confidentiality Compression E-mail compatibility Segmentation
- 7. Compression PGP compresses the message after applying the signature but before encryption The placement of the compression algorithm is critical. The compression algorithm used is ZIP (described in appendix 5A)
- 8. E-mail Compatibility The scheme used is radix-64 conversion (see appendix 5B). The use of radix-64 expands the message by 33%.
- 9. Segmentation and Reassembly Often restricted to a maximum message length of 50,000 octets. Longer messages must be broken up into segments. PGP automatically subdivides a message that is to large. The receiver strip of all e-mail headers and reassemble the block.
- 10. Sumary of PGP Services
- 12. Format of PGP Message
- 16. The Use of Trust Key legitimacy field Signature trust field Owner trust field See Table 5.2 (W. Stallings)
- 18. Revoking Public Keys The owner issue a key revocation certificate. Normal signature certificate with a revote indicator. Corresponding private key is used to sign the certificate.
- 19. S/MIME Secure/Multipurpose Internet Mail Extension S/MIME will probably emerge as the industry standard. PGP for personal e-mail security
- 20. Simple Mail Transfer Protocol (SMTP, RFC 822) SMTP Limitations - Can not transmit, or has a problem with: executable files, or other binary files (jpeg image) “ national language” characters (non-ASCII) messages over a certain size ASCII to EBCDIC translation problems lines longer than a certain length (72 to 254 characters)
- 21. Header fields in MIME MIME-Version: Must be “1.0” -> RFC 2045, RFC 2046 Content-Type: More types being added by developers (application/word) Content-Transfer-Encoding: How message has been encoded (radix-64) Content-ID: Unique identifying character string. Content Description: Needed when content is not readable text (e.g.,mpeg)
- 22. S/MIME Functions Enveloped Data: Encrypted content and encrypted session keys for recipients. Signed Data: Message Digest encrypted with private key of “signer.” Clear-Signed Data: Signed but not encrypted. Signed and Enveloped Data: Various orderings for encrypting and signing.
- 23. Algorithms Used Message Digesting: SHA-1 and MDS Digital Signatures: DSS Secret-Key Encryption: Triple-DES, RC2/40 (exportable) Public-Private Key Encryption: RSA with key sizes of 512 and 1024 bits, and Diffie-Hellman (for session keys).
- 24. User Agent Role S/MIME uses Public-Key Certificates - X.509 version 3 signed by Certification Authority Functions: Key Generation - Diffie-Hellman, DSS, and RSA key-pairs. Registration - Public keys must be registered with X.509 CA. Certificate Storage - Local (as in browser application) for different services. Signed and Enveloped Data - Various orderings for encrypting and signing.
- 25. User Agent Role Example: Verisign (www.verisign.com) Class-1: Buyer’s email address confirmed by emailing vital info. Class-2: Postal address is confirmed as well, and data checked against directories. Class-3: Buyer must appear in person, or send notarized documents.
- 26. Recommended Web Sites PGP home page: www.pgp.com MIT distribution site for PGP S/MIME Charter S/MIME Central: RSA Inc.’s Web Site