An Introduction to Secure . Presented by: Addam Schroll IT Security & Privacy Analyst

An Introduction to Secure Email

Topics

ƒ Secure Email Basics

ƒ Types of Secure Email

Secure Email Services

ƒ Confidentiality

ƒ Message Integrity

Why do I want secure email?

ƒ Protect sensitive data

ƒ Prove authenticity to recipients

ƒ Send attachments normally filtered

How does Secure Email work?

ƒ Long answer

• That’s another talk entirely. ƒ Short answer

• Secure email uses a set cryptographic tools to encapsulate a message into a specially

Encryption

ƒ Think CryptoQuip

ƒ Means of hiding a message through substitution or rearranging letters

ƒ Requires a “key” to unlock the original message

Digital Signatures

ƒ A string of characters that uniquely identifies the signer of an electronic message.

ƒ Recipients are able to

• Verify message was from purported sender • Verify message was not modified in transit ƒ Sender cannot deny being originator of

Pick your poison

ƒ Most popular secure email standards

• S/MIME • OpenPGP

ƒ How are these different?

• Similar services

Hierarchical Trusts

ƒ Users all directly trust some central authority

ƒ Alice trusts Bob if Bob’s “chain of trust” traces back to the central authority

ƒ Driver’s License

• Issued by state authority to prove identity to others

Web of Trust

ƒ Incorporates user perception of trust

ƒ Any user can be an authority to verify others

ƒ Users can assign levels of trust

• Not all authorities are equal

S/MIME and Digital Certificates

ƒ IETF standard extending MIME

ƒ Most email clients already support S/MIME

ƒ Requires users have public keys to communicate securely

S/MIME Capable Clients

ƒ Apple Mail

ƒ Entourage

ƒ Eudora 7

ƒ Evolution ƒ Kmail ƒ Mozilla/Thunderbird ƒ Mutt ƒ Outlook ƒ Pine

OpenPGP

ƒ A defacto standard based on Pretty Good Privacy program

ƒ Users must be able to find others’ public keys

ƒ Requires additional 3rd party software

Finding public keys

ƒ Get public key from previous messages

ƒ Lookup via directory service

• PGP Key Servers (e.g. http://pgp.mit.edu)

• Purdue Electronic Directory

Trusting Keys

ƒ Equivalent to trusting link between identity and key

ƒ Must have a process for validating identity of key owner

• Documentation Check • Verbal Verification

GNU Privacy Guard

ƒ Freely available implementation of OpenPGP

protocol

ƒ Available for most platforms

ƒ Does not integrate directly with email clients

PGP Desktop 8.0

ƒ Commercial implementation of OpenPGP standard

ƒ Runs on Windows and MacOS X

ƒ Integrates with several common email clients

PGP Desktop 9.0

ƒ Acts as email proxy instead of client plugin

ƒ Allows secure email through any client

ƒ May require reconfiguration of email client connection settings

Issues with Secure Email

ƒ Who should have access to private keys?

ƒ How do we exchange public keys?

ƒ How do we assign trust?

Steps to Secure Email

ƒ Generate an Identity

ƒ Configure Secure Email software

ƒ Get public keys for recipients

Getting a Digital Certificate

ƒ Must be issued by an authority

• Organizational PKI • Third-party vendor

ƒ Free personal certificates available

• Thawte

• Global Trust • CACert

Thawte Personal Certificate

ƒ Enroll for Thawte ID via website

ƒ Request certificate for ID

• Must provide “national identification number”

ƒ By default, certificate includes email address but not name

Thawte Web of Trust

ƒ Receive trust points from notaries

• 50 points: Request certificate with name • 100 points: Eligible to be a notary

ƒ Several notaries on Purdue WL campus

How to Install a Certificate -Outlook

• Download from Thawte via IE • Set Security to High

• Automatically installed in certificate store • How do I view the certificate store?

How to Install a Certificate -Thunderbird

• Download from Thawte via IE • Export from certificate store • Import into Thunderbird

Generating PGP Keys

ƒ Specify identity to link to keys

ƒ Provide key type and size parameters

ƒ Add comments or even a digital photo

Outlook S/MIME Walkthrough

ƒ Outlook S/MIME Setup

ƒ Encrypting and signing messages

Thunderbird S/MIME Walkthrough

ƒ Thunderbird Setup

ƒ Encrypting and signing messages

PGP Desktop 9 Walkthrough

ƒ Interface Overview

ƒ Signing messages

ƒ Encrypting messages

ƒ Decrypting messages

Thunderbird GPG Walkthrough

ƒ Generate new key pair

ƒ Configure Enigmail settings

ƒ Encrypting and Signing Messages

ƒ Inline PGP vs. PGP/MIME

Secure Email Tips

ƒ Backup your keys!

ƒ Revoke certificates or PGP keys if compromised

ƒ Trusting a key should only be done after suitable verification with the owner

Secure Email Tips

ƒ Follow the Purdue Data Handling Guidelines

ƒ Encrypted email is a means of transport, not storage

References

Trust Models

www.pgpi.org/doc/pgpintro/#p20

Thawte Personal Certificates

www.thawte.com/secure-email/personal-email-certificates/index.html

S/MIME Tutorial

www.marknoble.com/tutorial/smime/smime.aspx

OpenPGP

www.openpgp.org

Pretty Good Privacy

www.pgp.com

Purdue Data Handling Guidelines

References

Gnu Privacy Guard

http://www.gnupg.org/

Enigmail OpenPGP Extension

enigmail.mozdev.org

NIST Guidelines on Electronic Mail Security (Draft)