E-mail Security

• Electronic mail is most widely used application on the internet to send and receive messages to other users. Due to this the security of email messages has become an extremely important issue.
• The Simple Mail Transfer Protocol (SMTP) is used for email communication. The three main email security protocols used are as follows:

1. Privacy Enhanced Mail (PEM):

• The Privacy Enhanced Mail (PEM) is an email security standard adopted by the Internet Architecture Board (IAB) that provides secure email communication over the internet.
• PEM supports the three main functions of encryption, non-repudiation and message integrity.
• Working- PEM starts with a canonical representation followed by digital signature, encryption and finally Base-64 encoding.

Step1- Canonical Representation: The sender and receiver of email communication can have different computer architectures and operating systems. It is possible that files are represented differently on these computers creating problems while creating message digests. PEM transforms each email message into an abstract i.e canonical representation which uses a uniform and independent format for sending and receiving.

Step2- Digital Signature: This is a typical process of digital signature which starts by creating a message digest of the email message using an algorithm such as MD2 or MD5. The message digest created is then encrypted with the sender’s private key to form the sender’s digital signature.

Step3- Encryption: In this step the original email and the digital signature are encrypted together with a symmetric key. DES algorithm can be used for this step.

Step4- Base-64 encoding: The Base-64 encoding process transforms arbitrary input into printable character output. In this technique the binary input is processed in blocks of 3 octets or 24 bits. These 24 bits are to be made up of 4 sets consisting of 6 bits. Each such set of 6 bits is mapped into an 8-bit output character in this process. This seems to be a straightforward process using a mapping table.

2. Pretty Good Privacy (PGP):

• The most significant aspects of PGP are that it supports the basic requirements of cryptography which is quite simple to use and is free along with its source code and documentation.
• Working- In PGP the sender of the message needs to include the identifiers of the algorithm used in the message along with the value of the keys. PGP starts with a digital signature followed by compression, encryption, digital signature and finally Base-64 encoding.

Step1-Digital Signature: In PGP it consists of the creation of a message digest for the email message using SHA-1 algorithm. The resulting message digest is then encrypted with the sender’s private key. The result is the sender’s digital signature.

Step2- Compression: This is an additional step in PGP where the input message as well as the digital signature are compressed together to reduce the size of the final message that will be transmitted. ZIP is used for this which is based on the Lempel-Ziv algorithm. This algorithm looks for repeated strings to store them in variables. It then replaces of these strings with a pointer to the corresponding variable. This requires only a few bits hence this method results in data being compressed.

Step3- Encryption: The compressed email and the digital signature are then encrypted with a symmetric key. The IDEA algorithm can be used for this step.

Step4-Digital Signature: In this step the symmetric key used for encryption in step3 is now encrypted with the receiver’s public key. The output of step 3 and step4 together form a digital envelope.

Step5- Base-64 encoding: The output of step 4 i.e the digital envelope is encoded by the Base-64 encoding method similar to the one used in PEM.

3. Secure Multipurpose Internet Mail Extensions (S/MIME):

• Multipurpose Internet Mail Extensions (MIME) system extends the basic email system by permitting users to send binary files using the basic email system.
• The basic MIME systems can be enhanced to provide security features called as Secure Multipurpose Internet Mail Extensions (S/MIME).
• S/MIME is similar to PGP which provides digital signatures and encryption of email messages.