Secure Part II Due Date: Sept 27 Points: 25 Points

Size: px

Start display at page:

Download "Secure E-Mail Part II Due Date: Sept 27 Points: 25 Points"

Ami Berry
8 years ago
Views:

1 Secure Part II Due Date: Sept 27 Points: 25 Points Objective 1. To explore a practical application of cryptography secure 2. To use public key encryption 3. To gain experience with the various cryptographic algorithms in use 4. To understand how public key certificates and certificate authorities are utilized Equipment Needed Thunderbird Client included with your UBuntu OS Internet Web-Browser, Mozilla Firefox Internet Access Background There are two widely used secure systems on the Internet, S/MIME and PGP. Both provide similar capabilities but differ in details with respect to how each treats the distribution and validation of public keys. In this lab we will be using S/MIME in tandem with the CAcert Free Community CA. In providing a secure e- mail service, the following types of algorithms are used: a public key encryption algorithm: the sender uses the recipients public key to encrypt a session key, and the recipient uses their private key to decrypt this session key. a block cipher (private key) algorithm, using the exchanged session key to encrypt the contents to protect them from disclosure a hash function is used to create a digest of the contents before encryption/after decryption, to be signed, or to verify the signature a public key signature algorithm, using the senders private key to sign the digest to protect the message from modification and to identify the sender; and then the recipient uses the sender s public key to verify this signature. In practice most of this happens automatically for the user. The area of most interest is how the keys used by the encryption and signature algorithms are obtained and their correctness guaranteed. S/MIME uses the X.509 public key certificate standards for this. The keys are distributed in a Public Key Certificate that binds a public key to some user s identify and that is issued and certified by a Certificate Authority (CA) which both sender and recipient trust and whose key they can use to verify the certificates. To use secure , each user must create a public/private key pair and have some certificate authority certify their public key as belonging to them. Then these certificates can be exchanged to enable secure communications to occur. It is this process that we will be exploring in this experience, as well as examining the contents of your certificate. This lab experience is partitioned into eight phases, some of which you have already completed: i. Configuring the Thunderbird client ii. Obtain the CAcert Root Certificate (Secure Part I)

To understand how public key certificates and certificate authorities are utilized Equipment Needed Thunderbird E-Mail Client included with your UBuntu OS Internet Web-Browser, Mozilla Firefox

2 iii. Generating your Keys and obtain your Certificate (Secure Part I) iv. Exporting your Key and Certificate (Secure Part I) v. Importing your Certificate and Root Certificate into Thunderbird vi. Sending a digitally signed vii. Receiving a digitally signed and encrypted viii. Sending a digitally signed and encrypted Procedure I. Configuring Thunderbird Client Follow these instructions VERY carefully, if not, your may be DELETED from the Clemson University servers and downloaded to Thunderbird. 1. Inside Ubuntu: Select Applications -> Internet -> Mozilla Thunderbird Mail/News 'New Account Setup' Wizard should appear. 2. Select ' Account' Enter your gmail.com account (xxx@g.clemson.edu) as your . Select POP For the 'Incoming Server' field type 'pop.gmail.com' For the Outgoing Server field type smtp.googl .com Change/Leave 'Incoming Name' as you wish. Change/Leave 'Account Name' as you wish. Sample Screenshot of Dialog Box

Sending a digitally signed and encrypted e-mail Procedure I.

3 Verify the Information is correct. Unclick Download messages now Click Finish 3. In ThunderBird 3.1 Select Edit -> Account Settings 3.2 Choose Outgoing-Server Select Edit if you have one listed Provide a description or leave blank your choice For Server Name enter smtp.googl .com For Port ensure port 587 is being used Under Security and Authentication CHECK User name and password For User Name enter xxx@g.clemson.edu Under Use Secure Connection select TLS Verify your information is correct and Click OK. Ensure the Dialog Box Looks as Below 3.3 Next Choose Server Setting from the left pane. 3.4 Ensure the Server Type is POP Mail Server. Server Name is pop.gmail.com and Port is Check Leave Messages on server. IMPORTANT 3.6 Check Until I delete them. IMPORTANT 3.7 Verify your information is correct and Click OK 4. Thunderbird Click the 'Get Mail' Icon (below the File option)

3.2.6 For User Name enter xxx@g.clemson.edu 3.2.7 Under Use Secure Connection select TLS. 3.2.8 Verify your information is correct and Click OK. Ensure the Dialog Box Looks as Below 3.

4 5. Your can now be retrieved via Thunderbird; you are done. II. Obtaining the CAcert Root Certificate (Secure Part I) III. Generate Your Keys and Obtain Your Certificate (Secure Part I) IV. Exporting your Key and Certificate (Secure Part I) V. Importing Your Certificate & Root Certificate into Thunderbird Now that you have your keys and certificate you can send signed to other people but not encrypted since you need to know the recipient s certificate first to do this. First, we need to ensure that Thunderbird knows about and will use the certificate you now have. You will need to take your exported client certificate and key (mykeys.p12), and the CAcert root certificate (cacert.pem) and import them into Thunderbird Client. Importing Your Certificate mykeys.p12 1. Open Thunderbird Select Edit -> Preferences -> Advanced -> Certificates 2. Click View Certificates Select Your Certificates tab if not previously selected and Click Import 3. Remember where you saved your certificate in the previous Experience, select mykeys.p12 and Click Open You will be prompted to enter the pass-phrase used to export the certificate. After your pass-phrase has been entered correctly, a 'Success' pop-up box will appear. Importing the Root Certificate cacert.pem 4. With the window still open, select the 'Authorities' tab and Click 'Import' 5. Again remembering where you saved the root certificate, select cacert.pem and Click Ok ; if you receive a warning indicating that the certificate was previously installed, that is fine. Specifying a Certificate to Digitally Sign and Encrypt/Decrypt 6. The last step before we are underway sending digitally signed is to configure Thunderbird to use the newly imported certificate. 7. Open Thunderbird (if not open)

Importing Your Certificate & Root Certificate into Thunderbird Now that you have your keys and certificate you can send signed email to other people but not encrypted email since you need to know the

5 Select Edit -> Account Settings -> Security (located in the left panel) 8. Under the 'Digital Signing' section 8.1 Click 'Select' and choose your imported 8.2 Check 'Digitally sign messages (by default)' 9. Under the 'Encryption' section 9.1 Click 'Select' and choose the same certificate selected in Select 'Required' 10. Click on the View Certificates button, select Authorities tab and then select CA Cert Signing Authority. Click on Edit and make sure that all 3 trust boxes are checked. 11. Click 'Ok' VI. Sending a Digitally Signed In the next part, you will send a digitally signed message to hcgrs@clemson.edu. 1. Open Thunderbird (if not open) Click the 'Write (Pen)' Icon to compose an message 2. Address the and insert your public and private keys in the message. 3. Click the down-arrow to the right of the 'Security (Pad-Lock)' icon 3.1 Select 'Do Not Encrypt this Message' 3.2 Select 'Digitally Sign this Message' (should have a check mark) 4. Hit 'Send'. 5. The message was sent with your digital signature. You will receive a digitally-signed, encrypted message in return. Note that when you view the message, you may be told that a new certificate is being added and that the message signature is Good. You can view the details of the signature and the certificate by opening the and clicking on the Envelope icon, which indicates the message has been digitally-signed. VII. Sending a Digitally Signed & Encrypted 1. AFTER you have received a 'Digitally Signed, Encrypted ', Thunderbird automatically extracts the public key from the digital signature and stores this for you to later encrypt with the recipient's public key. Compose a second message as directed in the encrypted Address the and insert the items that the encrypted message from Dr Grossman describes. 3. Click the down-arrow to the right of the 'Security (Pad-Lock)' icon 3.1 Select 'Encrypt this Message' 3.2 Select 'Digitally Sign this Message' (should have a check mark) 4. Hit 'Send' 5. The message was sent encrypted with the recipient's public key and with your digital signature.

Click on the View Certificates button, select Authorities tab and then select CA Cert Signing Authority. Click on Edit and make sure that all 3 trust boxes are checked. 11. Click 'Ok' VI.

6 In the digitally-signed and encrypted that you received, you can view the details regarding the message s security by selecting the pad-lock icon window that indicates the message has been encrypted. in the message Reporting in one digitally-signed message the following to grossman@cs.clemson.edu with a subject line of Secure Request. Failure to use the correct subject line will result in a 10 point deduction for this experience. 1. In the body of the message, send your public and private keys clearly denoting each 2. Additional directions will be returned via the encrypted, digitally signed message

edu with a subject line of Secure E-Mail Request. Failure to use the correct subject line will result in a 10

Exostar LDAP Proxy / SecureEmail Setup Guide. This document provides information on the following topics:

Exostar LDAP Proxy / SecureEmail Setup Guide. This document provides information on the following topics: This document provides information on the following topics: Email Encryption set-up Outlook 2003 Email Encryption set-up Outlook 2007 Email Encryption set-up Outlook 2010 Email Encryption set-up Outlook