E-Mail Security - Revision history

AMessner: /* Integrity */

2024-12-17T12:04:08Z

Integrity

← Older revision		Revision as of 12:04, 17 December 2024
Line 12:		Line 12:
	=== Integrity ===		=== Integrity ===
	* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.		* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.
	* TLS 1.3 Authenticated Encryption with Associated Data (AEAD) ciphers.		* TLS 1.3 uses Authenticated Encryption with Associated Data (AEAD) ciphers.

	=== Authentication ===		=== Authentication ===

AMessner: /* Integrity */

2024-12-17T12:03:49Z

Integrity

← Older revision		Revision as of 12:03, 17 December 2024
Line 47:		Line 47:
	=== Integrity ===		=== Integrity ===
	* OpenPGP advices to use AEAD algorithms.		* OpenPGP advices to use AEAD algorithms.
			* Older Implementations used MDC (Message Detection Code), or a simple Signature on a hash digest.

	=== Authentication ===		=== Authentication ===

AMessner: /* Integrity */

2024-12-17T12:01:42Z

Integrity

← Older revision		Revision as of 12:01, 17 December 2024
Line 12:		Line 12:
	=== Integrity ===		=== Integrity ===
	* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.		* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.
	* TLS 1.3 Authenticated Encryption with Associated Data (AEAD) ~~cyphers~~.		* TLS 1.3 Authenticated Encryption with Associated Data (AEAD) ciphers.

	=== Authentication ===		=== Authentication ===

AMessner: /* Transport Layer Security (TLS) */

2024-12-17T12:00:10Z

Transport Layer Security (TLS)

← Older revision		Revision as of 12:00, 17 December 2024
Line 12:		Line 12:
	=== Integrity ===		=== Integrity ===
	* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.		* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.
			* TLS 1.3 Authenticated Encryption with Associated Data (AEAD) cyphers.

	=== Authentication ===		=== Authentication ===

AMessner: /* Secure/Multipurpose Internet Mail Extensions (S/MIME) */

2024-12-17T11:43:42Z

Secure/Multipurpose Internet Mail Extensions (S/MIME)

← Older revision		Revision as of 11:43, 17 December 2024
Line 79:		Line 79:
	* A hash of the email content is signed using the sender's private key.		* A hash of the email content is signed using the sender's private key.
	* The recipient verifies the signature using the sender's public key, ensuring authenticity and integrity.		* The recipient verifies the signature using the sender's public key, ensuring authenticity and integrity.
			* S/MIME specification advices to use AEAD algorithms.

	=== Authentication ===		=== Authentication ===
Line 115:		Line 116:
	\| Complexity \|\| Low \|\| Moderate \|\| Moderate		\| Complexity \|\| Low \|\| Moderate \|\| Moderate
	\|}		\|}


	== Courses ==		== Courses ==

AMessner at 11:42, 17 December 2024

2024-12-17T11:42:24Z

← Older revision		Revision as of 11:42, 17 December 2024
Line 45:		Line 45:

	=== Integrity ===		=== Integrity ===
	* OpenPGP ~~ensures message integrity with the MDC, which appends a cryptographic hash~~ to ~~the plaintext before encryption. If tampered, the hash comparison will fail upon decryption~~.		* OpenPGP advices to use AEAD algorithms.

	=== Authentication ===		=== Authentication ===

AMessner at 18:12, 16 December 2024

2024-12-16T18:12:52Z

← Older revision		Revision as of 18:12, 16 December 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==

	~~Description what this documentation is about~~.		This article provides a detailed comparison and explanation of three major encryption methods used for securing email communication: Transport Layer Security (TLS), OpenPGP, and Secure/Multipurpose Internet Mail Extensions (S/MIME).

	== Transport Layer Security (TLS) ==		== Transport Layer Security (TLS) ==

AMessner at 18:11, 16 December 2024

2024-12-16T18:11:32Z

← Older revision		Revision as of 18:11, 16 December 2024
Line 27:		Line 27:
	#* A session key, that will be used as a symmetric key, is exchanged using encrypted key-exchange.		#* A session key, that will be used as a symmetric key, is exchanged using encrypted key-exchange.
	#* MACs ensure that data integrity is preserved.		#* MACs ensure that data integrity is preserved.

	# TLS Record Protocol		# TLS Record Protocol
	#* After the handshake, the Record Protocol manages the symmetric encrypted transmission of data.		#* After the handshake, the Record Protocol manages the symmetric encrypted transmission of data.
Line 34:		Line 33:

	=== Limitations ===		=== Limitations ===
	* '''Encryption Only During Transmission:''' TLS protects emails only during transmission. Once the email reaches the server or the recipient's device, the content is unencrypted and stored as plain text unless additional end-to-end ~~encryption~~ encryption is used.		* '''Encryption Only During Transmission:''' TLS protects emails only during transmission. Once the email reaches the server or the recipient's device, the content is unencrypted and stored as plain text unless additional end-to-end encryption is used.
	* '''No Guarantee of TLS Usage at Every Step in Communication:''' TLS cannot guarantee encryption for the entire journey of an email. After leaving the sender's device, emails often pass through multiple intermediary Mail Transfer Agents (MTAs) before reaching the recipient. If any of these MTAs do not support or enforce TLS, the email may be transmitted in plaintext, exposing it to potential interception. Additionally, the sender has no control over whether these intermediary MTAs adhere to TLS requirements, leaving a gap in secure delivery.		* '''No Guarantee of TLS Usage at Every Step in Communication:''' TLS cannot guarantee encryption for the entire journey of an email. After leaving the sender's device, emails often pass through multiple intermediary Mail Transfer Agents (MTAs) before reaching the recipient. If any of these MTAs do not support or enforce TLS, the email may be transmitted in plaintext, exposing it to potential interception. Additionally, the sender has no control over whether these intermediary MTAs adhere to TLS requirements, leaving a gap in secure delivery.

	== OpenPGP ==		== OpenPGP ==
	OpenPGP is an encryption standard designed to provide end-to-end encryption, ensuring that only the intended recipient can read the message. It combines symmetric and asymmetric cryptography, as well as digital signatures, to achieve confidentiality, authenticity, and integrity. It uses ~~Compresses~~ to reduce the size of the email content before encryption. OpenPGP uses the Web of Trust or other communication channels to share Public Keys.		OpenPGP is an encryption standard designed to provide end-to-end encryption, ensuring that only the intended recipient can read the message. It combines symmetric and asymmetric cryptography, as well as digital signatures, to achieve confidentiality, authenticity, and integrity. It uses compression to reduce the size of the email content before encryption. OpenPGP uses the Web of Trust or other communication channels to share Public Keys.

	=== Confidentiality ===		=== Confidentiality ===
Line 56:		Line 55:
	#* The email content is compressed and encrypted using the session key.		#* The email content is compressed and encrypted using the session key.
	#* The session key is encrypted using the recipient's public key and attached to the message.		#* The session key is encrypted using the recipient's public key and attached to the message.

	# Decryption Process:		# Decryption Process:
	#* The recipient decrypts the session key using their private key.		#* The recipient decrypts the session key using their private key.
	#* The session key is used to decrypt the email content.		#* The session key is used to decrypt the email content.
	#* If compression was used, the message is decompressed after decryption.		#* If compression was used, the message is decompressed after decryption.

	# Digital Signature:		# Digital Signature:
	#* A hash of the email is created using a cryptographic hash function.		#* A hash of the email is created using a cryptographic hash function.
Line 85:		Line 82:
	=== Authentication ===		=== Authentication ===
	* Certificates issued by trusted Certificate Authorities (CAs) manage sender verification.		* Certificates issued by trusted Certificate Authorities (CAs) manage sender verification.
	* Digital Signatures are used to verify the sender's identity, a hash is signed with the sender's private key.		* Digital Signatures are used to verify the sender's identity, a hash of the message is signed with the sender's private key.

	=== How S/MIME operates ===		=== How S/MIME operates ===
Line 91:		Line 88:
	#* The sender generates a random CEK to encrypt the email content using a symmetric encryption algorithm.		#* The sender generates a random CEK to encrypt the email content using a symmetric encryption algorithm.
	#* The CEK is encrypted using the recipient's public key and attached to the message.		#* The CEK is encrypted using the recipient's public key and attached to the message.

	# Decryption:		# Decryption:
	#* The recipient decrypts the CEK using their private key.		#* The recipient decrypts the CEK using their private key.
	#* The CEK is then used to decrypt the email content.		#* The CEK is then used to decrypt the email content.

	# Digital Signatures:		# Digital Signatures:
	#* A hash of the email content is signed using the sender's private key.		#* A hash of the email content is signed using the sender's private key.

AMessner at 18:03, 16 December 2024

2024-12-16T18:03:20Z

Show changes

AMessner: Created page with "== Summary == Description what this documentation is about. == Transport Layer Security (TLS) == TLS is a cryptographic protocol that secures communications over a network by providing confidentiality, integrity, and authentication. It is commonly used to secure connections between a client and a server, as well as between servers. === Confidentiality === * Data is encrypted during transit to ensure it cannot be intercepted and read. * TLS uses asymmetric encryption..."

2024-12-16T17:15:23Z

Created page with "== Summary == Description what this documentation is about. == Transport Layer Security (TLS) == TLS is a cryptographic protocol that secures communications over a network by providing confidentiality, integrity, and authentication. It is commonly used to secure connections between a client and a server, as well as between servers. === Confidentiality === * Data is encrypted during transit to ensure it cannot be intercepted and read. * TLS uses asymmetric encryption..."

New page

== Summary ==

Description what this documentation is about.

== Transport Layer Security (TLS) ==
TLS is a cryptographic protocol that secures communications over a network by providing confidentiality, integrity, and authentication. It is commonly used to secure connections between a client and a server, as well as between servers.

=== Confidentiality ===
* Data is encrypted during transit to ensure it cannot be intercepted and read.
* TLS uses asymmetric encryption during the handshake phase to securely exchange a symmetric session key, which is then used for fast and efficient encryption of the data.

=== Integrity ===
* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.

=== Authentication ===
* TLS uses digital certificates issued by trusted Certificate Authorities (CAs) to confirm the identity of the communicating parties.
* The server presents its certificate to the client during the handshake phase to prove its legitimacy.
* Optionally, mutual authentication can occur, where the client also provides its certificate.

=== How TLS operates ===
TLS operates in two stages:

# TLS Handshake Protocol
* This phase negotiates security parameters, including the cryptographic algorithms to be used (cipher suites).
* The server sends its certificate to the client, which verifies the certificate against trusted CAs.
* Optional client authentication can occur here if needed.
* A session key, that will be used as a symmetric key, is exchanged using encrypted key-exchange.
* MACs ensure that data integrity is preserved.

# TLS Record Protocol
* After the handshake, the Record Protocol manages the symmetric encrypted transmission of data.
* Data is encrypted using the session key established during the handshake.
* MACs ensure that data integrity is preserved.

=== Limitations ===
*In-Transit Only: TLS protects emails only during transmission. Once the email reaches the server or the recipient's device, the content is unencrypted and stored as plain text unless additional encryption is used.
*Intermediary MTAs: The sender cannot enforce TLS on intermediary Mail Transfer Agents (MTAs). Some MTAs may not support TLS, leaving messages vulnerable during transit.

== OpenPGP ==

=== Confidentiality ===

=== Integrity ===

=== Authentication ===

== Secure/Multipurpose Internet Mail Extensions (S/MIME) ==

=== Confidentiality ===

=== Integrity ===

=== Authentication ===

=== Step 1 ===
Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[Ausgewählte Kapitel der IT-Security]] (2024)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]