E-mail Security.ppt
- 1. E-mail Security: S/MIME and PGP
- 2. Email security protocols The two schemes that provide security services on email are: S/MIME (Secure/ Multipurpose Internet Mail Extension) PGP (Pretty Good Privacy)
- 3. Standard for email service: RFC 822 Describes the standard for e-mail format. Overall structure is very simple Message = Envelope + Content - Envelope: Whatever information is required to accomplish transmission and delivery - Content: The message body
- 4. Limitations of RFC 822 • Cannot be used to transmit: – Executable files – Images – Audio files, etc. • Text character set limited to ASCII. • Transfer size is also limited.
- 5. MIME (Multipurpose Internet Mail Extension) • Extension to RFC 822 framework • MIME specification includes following elements: – Defines new message header fields – A number of content format are there to support multimedia email – Content Transfer encodings are defined
- 6. S/MIME
- 7. S/MIME (Secure/MIME) Originally developed by RSA Data Security Inc. Build on top two Public Key Cryptography Standards: "PKCS #7: Cryptographic Message Syntax” "PKCS #10: Certification Request Syntax“ Commercially very successful. Application not limited to e-mail. Any protocol that transports MIME objects can leverage these services such as HTTP.
- 8. Security Services • Digital Signature Message origin Authentication • Digital Signature Message Integrity • Encryption Message Confidentiality • Digital Signature Non repudiation of Origin
- 9. S/MIME services • enveloped data (application/pkcs7-mime; smime-type = enveloped-data) – standard digital envelop • signed data (application/pkcs7-mime; smime-type = signed-data) – standard digital signature – content + signature is encoded using base64 encoding • clear-signed data (multipart/signed) – standard digital signature – only the signature is encoded using base64 – recipient without S/MIME capability can read the message but cannot verify the signature • signed and enveloped data – signed and encrypted items may be nested in any order
- 10. S/MIME functions (Signed Data) Select a message digest algorithm (SHA or MD5) Compute message digest of the content to be signed. Sign message digest with signer’s private key. Prepare a block called SignerInfo that contains signer’s public key certificate, an identifier for Message Digest algorithm, an identifier for algorithm used to sign message digest.