An Introduction to Secure . Presented by: Addam Schroll IT Security & Privacy Analyst

Size: px

Start display at page:

Download "An Introduction to Secure Email. Presented by: Addam Schroll IT Security & Privacy Analyst"

Alannah Arleen Reynolds
10 years ago
Views:

1 An Introduction to Secure Presented by: Addam Schroll IT Security & Privacy Analyst

2 Topics Secure Basics Types of Secure Walkthroughs 2

3 Secure Services Confidentiality Message Integrity Sender Authentication 3

4 Protect sensitive data Why do I want secure ? Prove authenticity to recipients Send attachments normally filtered Avoid the junk folder! 4

5 How does Secure work? Long answer That s another talk entirely. Short answer Secure uses a set cryptographic tools to encapsulate a message into a specially formatted envelope. 5

6 Encryption Think CryptoQuip Means of hiding a message through substitution or rearranging letters Requires a key to unlock the original message 6

7 Digital Signatures A string of characters that uniquely identifies the signer of an electronic message. Recipients are able to Verify message was from purported sender Verify message was not modified in transit Sender cannot deny being originator of message 7

Recipients are able to Verify message was from purported sender

8 Pick your poison Most popular secure standards S/MIME OpenPGP How are these different? Similar services Different trust models 8

9 Hierarchical Trusts Users all directly trust some central authority Alice trusts Bob if Bob s chain of trust traces back to the central authority Driver s License Issued by state authority to prove identity to others 9

trust traces back to the central authority Driver s

10 Web of Trust Incorporates user perception of trust Any user can be an authority to verify others Users can assign levels of trust Not all authorities are equal Alice and Bob think she is Carol, and that s good enough for me. 10

assign levels of trust Not all authorities are equal

11 S/MIME and Digital Certificates IETF standard extending MIME Most clients already support S/MIME Requires users have public keys to communicate securely Where do users get this key? 11

12 S/MIME Capable Clients Apple Mail Entourage Eudora 7 Evolution Kmail Mozilla/Thunderbird Mutt Outlook Pine 12

13 OpenPGP A defacto standard based on Pretty Good Privacy program Users must be able to find others public keys Requires additional 3 rd party software Several implementations available 13

14 Finding public keys Get public key from previous messages Lookup via directory service PGP Key Servers (e.g. Purdue Electronic Directory Distributed via Public Key Infrastructure 14

15 Trusting Keys Equivalent to trusting link between identity and key Must have a process for validating identity of key owner Documentation Check Verbal Verification 15

16 GNU Privacy Guard Freely available implementation of OpenPGP protocol Available for most platforms Does not integrate directly with clients Integrates with Thunderbird through Enigmail 16

17 PGP Desktop 8.0 Commercial implementation of OpenPGP standard Runs on Windows and MacOS X Integrates with several common clients 17

18 PGP Desktop 9.0 Acts as proxy instead of client plugin Allows secure through any client May require reconfiguration of client connection settings 18

19 Issues with Secure Who should have access to private keys? How do we exchange public keys? How do we assign trust? Should group keys be issued? 19

20 Generate an Identity Steps to Secure Configure Secure software Get public keys for recipients Start sending secured messages 20

21 Getting a Digital Certificate Must be issued by an authority Organizational PKI Third-party vendor Free personal certificates available Thawte Global Trust CACert Comodo 21

22 Thawte Personal Certificate Enroll for Thawte ID via website Request certificate for ID Must provide national identification number By default, certificate includes address but not name No validation done to link identity to address yet 22

23 Thawte Web of Trust Receive trust points from notaries 50 points: Request certificate with name 100 points: Eligible to be a notary Several notaries on Purdue WL campus Hint: One is probably up front talking right now 23

24 Download from Thawte via IE How to Install a Certificate - Outlook Set Security to High Automatically installed in certificate store How do I view the certificate store? Control Panel->Internet Options->Content->Certificates 24

28 Download from Thawte via IE How to Install a Certificate - Thunderbird Export from certificate store Import into Thunderbird Options->Privacy->Security->View Certificates->Import 28

30 Specify identity to link to keys Generating PGP Keys Provide key type and size parameters Add comments or even a digital photo Choose a strong passphrase 30

35 Outlook S/MIME Setup Outlook S/MIME Walkthrough Encrypting and signing messages Decrypting and Verifying messages 35

40 Thunderbird Setup Thunderbird S/MIME Walkthrough Encrypting and signing messages Decrypting and Verifying messages 40

45 Interface Overview Signing messages Encrypting messages Decrypting messages Backing up key pairs PGP Desktop 9 Walkthrough 45

53 Generate new key pair Configure Enigmail settings Thunderbird GPG Walkthrough Encrypting and Signing Messages Inline PGP vs. PGP/MIME Decrypting and Verifying Messages 53

55 Using GPG with Thunderbird

60 Secure Tips Backup your keys! Revoke certificates or PGP keys if compromised Trusting a key should only be done after suitable verification with the owner 60

61 Secure Tips Follow the Purdue Data Handling Guidelines Encrypted is a means of transport, not storage File your sensitive information elsewhere 61

62 Just because you can, doesn t mean you should. 62

63 References Trust Models Thawte Personal Certificates S/MIME Tutorial OpenPGP Pretty Good Privacy Purdue Data Handling Guidelines 63

64 References Gnu Privacy Guard Enigmail OpenPGP Extension enigmail.mozdev.org NIST Guidelines on Electronic Mail Security (Draft) 64

Tutorial: Encrypted Email with Thunderbird and Enigmail. Author: Shashank Areguli. Published: Ed (August 9, 2014)

Tutorial: Encrypted Email with Thunderbird and Enigmail Author: Shashank Areguli Published: Ed (August 9, 2014) There are three issues of security that needs to dealt with on the internet, concerning information.