Network Security Network Security
Essentials Essentials
Chapter 7 Chapter 7
Fourth Edition Fourth Edition by William Stallings by William Stallings
Lecture slides by Lawrie Brown Lecture slides by Lawrie Brown
Chapter 7 –
Chapter 7 – Electronic Mail Electronic Mail Security
Security
Despite the refusal of VADM Poindexter and LtCol North to Despite the refusal of VADM Poindexter and LtCol North to
appear, the Board's access to other sources of appear, the Board's access to other sources of
information filled much of this gap. The FBI provided information filled much of this gap. The FBI provided
documents taken from the files of the National Security documents taken from the files of the National Security
Advisor and relevant NSC staff members, including Advisor and relevant NSC staff members, including
messages from the PROF system between VADM messages from the PROF system between VADM
Poindexter and LtCol North. The PROF messages were Poindexter and LtCol North. The PROF messages were
conversations by computer, written at the time events conversations by computer, written at the time events occurred and presumed by the writers to be protected occurred and presumed by the writers to be protected
from disclosure. In this sense, they provide a first-hand, from disclosure. In this sense, they provide a first-hand,
contemporaneous account of events.
contemporaneous account of events.
——The Tower Commission Report to President Reagan The Tower Commission Report to President Reagan on the Iran-Contra Affair, 1987
on the Iran-Contra Affair, 1987
Email Security Email Security
email is one of the most widely used and email is one of the most widely used and regarded network services
regarded network services
currently message contents are not secure currently message contents are not secure
may be inspected either in transit may be inspected either in transit
or by suitably privileged users on destination or by suitably privileged users on destination system
system
Email Security Enhancements Email Security Enhancements
confidentialityconfidentiality
protection from disclosureprotection from disclosure
authenticationauthentication
of sender of messageof sender of message
message integritymessage integrity
protection from modification protection from modification
non-repudiation of originnon-repudiation of origin
protection from denial by senderprotection from denial by sender
Pretty Good Privacy (PGP) Pretty Good Privacy (PGP)
widely used de facto secure emailwidely used de facto secure email
developed by Phil Zimmermanndeveloped by Phil Zimmermann
selected best available crypto algs to useselected best available crypto algs to use
integrated into a single programintegrated into a single program
on Unix, PC, Macintosh and other systems on Unix, PC, Macintosh and other systems
originally free, now also have commercial originally free, now also have commercial versions available
versions available
PGP Operation – PGP Operation –
Authentication Authentication
1.1. sender creates messagesender creates message
2.2. make SHA-1160-bit hash of message make SHA-1160-bit hash of message
3.3. attached RSA signed hash to messageattached RSA signed hash to message
4.4. receiver decrypts & recovers hash codereceiver decrypts & recovers hash code
5.5. receiver verifies received message hashreceiver verifies received message hash
PGP Operation – PGP Operation –
Confidentiality Confidentiality
1.1. sender forms 128-bit random session keysender forms 128-bit random session key
2.2. encrypts message with session keyencrypts message with session key
3.3. attaches session key encrypted with RSAattaches session key encrypted with RSA
4.4. receiver decrypts & recovers session keyreceiver decrypts & recovers session key
5.5. session key is used to decrypt messagesession key is used to decrypt message
PGP Operation – Confidentiality PGP Operation – Confidentiality
& Authentication
& Authentication
can use both services on same messagecan use both services on same message
create signature & attach to messagecreate signature & attach to message
encrypt both message & signatureencrypt both message & signature
attach RSA/ElGamal encrypted session keyattach RSA/ElGamal encrypted session key
PGP Operation – PGP Operation –
Compression Compression
by default PGP compresses message by default PGP compresses message after signing but before encrypting
after signing but before encrypting
so can store uncompressed message & so can store uncompressed message &
signature for later verification signature for later verification
& because compression is non deterministic& because compression is non deterministic
uses ZIP compression algorithmuses ZIP compression algorithm
PGP Operation – Email PGP Operation – Email
Compatibility Compatibility
when using PGP will have binary data to send when using PGP will have binary data to send (encrypted message etc)
(encrypted message etc)
however email was designed only for texthowever email was designed only for text
hence PGP must encode raw binary data into hence PGP must encode raw binary data into printable ASCII characters
printable ASCII characters
uses radix-64 algorithmuses radix-64 algorithm
maps 3 bytes to 4 printable charsmaps 3 bytes to 4 printable chars
also appends a CRCalso appends a CRC
PGP also segments messages if too bigPGP also segments messages if too big
PGP Operation – Summary
PGP Operation – Summary
PGP Session Keys PGP Session Keys
need a session key for each messageneed a session key for each message
of varying sizes: 56-bit DES, 128-bit CAST or of varying sizes: 56-bit DES, 128-bit CAST or IDEA, 168-bit Triple-DES
IDEA, 168-bit Triple-DES
generated using ANSI X12.17 modegenerated using ANSI X12.17 mode
uses random inputs taken from previous uses random inputs taken from previous uses and from keystroke timing of user uses and from keystroke timing of user
PGP Public & Private Keys PGP Public & Private Keys
since many public/private keys may be in use, since many public/private keys may be in use, need to identify which is actually used to encrypt need to identify which is actually used to encrypt
session key in a message session key in a message
could send full public-key with every messagecould send full public-key with every message
but this is inefficientbut this is inefficient
rather use a key identifier based on keyrather use a key identifier based on key
is least significant 64-bits of the keyis least significant 64-bits of the key
will very likely be uniquewill very likely be unique
also use key ID in signaturesalso use key ID in signatures
PGP Message Format
PGP Message Format
PGP Key Rings PGP Key Rings
each PGP user has a pair of keyrings:each PGP user has a pair of keyrings:
public-key ring contains all the public-keys of public-key ring contains all the public-keys of other PGP users known to this user, indexed other PGP users known to this user, indexed
by key ID by key ID
private-key ring contains the public/private private-key ring contains the public/private key pair(s) for this user, indexed by key ID &
key pair(s) for this user, indexed by key ID &
encrypted keyed from a hashed passphrase encrypted keyed from a hashed passphrase
security of private keys thus depends on security of private keys thus depends on the pass-phrase security
the pass-phrase security
PGP Key Rings
PGP Key Rings
PGP Message Generation
PGP Message Generation
PGP Message Reception
PGP Message Reception
PGP Key Management PGP Key Management
rather than relying on certificate authoritiesrather than relying on certificate authorities
in PGP every user is own CAin PGP every user is own CA
can sign keys for users they know directlycan sign keys for users they know directly
forms a “web of trust”forms a “web of trust”
trust keys have signedtrust keys have signed
can trust keys others have signed if have a chain of can trust keys others have signed if have a chain of signatures to them
signatures to them
key ring includes trust indicatorskey ring includes trust indicators
users can also revoke their keysusers can also revoke their keys
PGP Trust Model Example
PGP Trust Model Example
S/MIME (Secure/Multipurpose S/MIME (Secure/Multipurpose
Internet Mail Extensions) Internet Mail Extensions)
security enhancement to MIME emailsecurity enhancement to MIME email
original Internet RFC822 email was text onlyoriginal Internet RFC822 email was text only
MIME provided support for varying content MIME provided support for varying content types and multi-part messages
types and multi-part messages
with encoding of binary data to textual formwith encoding of binary data to textual form
S/MIME added security enhancementsS/MIME added security enhancements
have S/MIME support in many mail agentshave S/MIME support in many mail agents
eg MS Outlook, Mozilla, Mac Mail etceg MS Outlook, Mozilla, Mac Mail etc
S/MIME Functions S/MIME Functions
enveloped dataenveloped data
encrypted content and associated keysencrypted content and associated keys
signed datasigned data
encoded message + signed digestencoded message + signed digest
clear-signed dataclear-signed data
cleartext message + encoded signed digestcleartext message + encoded signed digest
signed & enveloped datasigned & enveloped data
nesting of signed & encrypted entitiesnesting of signed & encrypted entities
S/MIME Cryptographic S/MIME Cryptographic
Algorithms Algorithms
digital signatures: DSS & RSAdigital signatures: DSS & RSA
hash functions: SHA-1 & MD5hash functions: SHA-1 & MD5
session key encryption: ElGamal & RSAsession key encryption: ElGamal & RSA
message encryption: AES, Triple-DES, message encryption: AES, Triple-DES, RC2/40 and others
RC2/40 and others
MAC: HMAC with SHA-1MAC: HMAC with SHA-1
have process to decide which algs to usehave process to decide which algs to use
S/MIME Messages S/MIME Messages
S/MIME secures S/MIME secures a MIME entity with a a MIME entity with a signature, encryption, or both
signature, encryption, or both
forming a MIME wrapped PKCS objectforming a MIME wrapped PKCS object
have a range of content-types:have a range of content-types:
enveloped dataenveloped data
signed datasigned data
clear-signed dataclear-signed data
registration requestregistration request
certificate only messagecertificate only message
S/MIME Certificate S/MIME Certificate
Processing Processing
S/MIME uses X.509 v3 certificatesS/MIME uses X.509 v3 certificates
managed using a hybrid of a strict X.509 managed using a hybrid of a strict X.509 CA hierarchy & PGP’s web of trust
CA hierarchy & PGP’s web of trust
each client has a list of trusted CA’s certseach client has a list of trusted CA’s certs
and own public/private key pairs & certsand own public/private key pairs & certs
certificates must be signed by trusted CA’scertificates must be signed by trusted CA’s
Certificate Authorities Certificate Authorities
have several well-known CA’shave several well-known CA’s
Verisign one of most widely usedVerisign one of most widely used
Verisign issues several types of Digital IDsVerisign issues several types of Digital IDs
increasing levels of checks & hence trustincreasing levels of checks & hence trust
Class
Class Identity ChecksIdentity Checks UsageUsage
11 name/email checkname/email check web browsing/emailweb browsing/email
22 + enroll/addr check+ enroll/addr check email, subs, s/w validateemail, subs, s/w validate 33 + ID documents+ ID documents e-banking/service accesse-banking/service access
S/MIME Enhanced Security S/MIME Enhanced Security
Services Services
3 proposed enhanced security services:3 proposed enhanced security services:
signed receiptssigned receipts
security labelssecurity labels
secure mailing listssecure mailing lists
Domain Keys Identified Mail Domain Keys Identified Mail
a specification for cryptographically a specification for cryptographically signing email messages
signing email messages
so signing domain claims responsibilityso signing domain claims responsibility
recipients / agents can verify signaturerecipients / agents can verify signature
proposed Internet Standard RFC 4871proposed Internet Standard RFC 4871
has been widely adopted has been widely adopted
Internet Mail Architecture
Internet Mail Architecture
Email Threats Email Threats
see RFC 4684- see RFC 4684- Analysis of Threats Analysis of Threats
Motivating DomainKeys Identified Mail Motivating DomainKeys Identified Mail
describes the problem space in terms of:describes the problem space in terms of:
range: low end, spammers, fraudstersrange: low end, spammers, fraudsters
capabilities in terms of where submitted, capabilities in terms of where submitted, signed, volume, routing naming etc
signed, volume, routing naming etc
outside located attackersoutside located attackers
DKIM DKIM Strategy Strategy
transparent transparent to user
to user
MSA signMSA sign
MDA verifyMDA verify
for pragmatic for pragmatic reasons
reasons
DCIM DCIM
Functional Functional
Flow Flow
Summary Summary
have considered:have considered:
secure emailsecure email
PGPPGP
S/MIMES/MIME
domain-keys identified emaildomain-keys identified email
