If you’re planning to take the SY0-501 version of the Security+ exam, you should have a basic understanding of the basic concepts of cryptography. This includes ensuring confidentiality of email by encrypting and decrypting email contents.
For example, can you answer this question?
Q. Bart wants to send a secure email to Lisa, so he decides to encrypt it. Bart wants to ensure that Lisa can verify that he sent it. Which of the following does Lisa need to meet this requirement?
A. Bart’s public key
B. Bart’s private key
C. Lisa’s public key
D. Lisa’s private key
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
There are times when you want to ensure that email messages are only readable by authorized users. You can encrypt email and just as any other time encryption is used, encryption provides confidentiality.
Encrypting Email with Only Asymmetric Encryption
Imagine that Lisa wants to send an encrypted message to Bart. The following steps provide a simplified explanation of the process if only asymmetric encryption is used:
1. Lisa retrieves a copy of Bart’s certificate that contains his public key.
2. Lisa encrypts the email with Bart’s public key.
3. Lisa sends the encrypted email to Bart.
4. Bart decrypts the email with his private key.
This works because Bart is the only person who has access to his private key. If attackers intercepted the email, they couldn’t decrypt it without Bart’s private key. It’s important to remember that when you’re encrypting email contents, the recipient’s public key encrypts and the recipient’s private key decrypts. The sender’s keys are not involved in this process. In contrast, a digital signature only uses the sender’s keys but not the recipient’s keys.
In most cases, the public key doesn’t actually encrypt the message, but instead encrypts a symmetric key used to encrypt the email. The recipient then uses the private key to decrypt the symmetric key, and then uses the symmetric key to decrypt the email.
Encrypting Email with Asymmetric and Symmetric Encryption
The previous description provides a simplistic explanation of email encryption used by some email applications. However, most email applications combine both asymmetric and symmetric encryption. You may remember from earlier in this chapter that asymmetric encryption is slow and inefficient, but symmetric encryption is very quick.
Instead of using only symmetric encryption, most email applications use asymmetric encryption to privately share a session key. They then use symmetric encryption to encrypt the data. For example, imagine that Lisa is sending Bart an encrypted message. The figure (steps 1 to 4) shows the process of encrypting the message and the symmetric key. The next figure (steps 5 to 7) shows the process of sending the encrypted message and encrypted session key, and identifies how the recipient can decrypt the data:
1. Lisa identifies a symmetric key to encrypt her email. For this example, assume it’s a simplistic symmetric key of 53, though a symmetric algorithm like AES would use 128- bit or larger keys.
2. Lisa encrypts the email contents with the symmetric key of 53.
3. Lisa retrieves a copy of Bart’s certificate that contains his public key.
4. She uses Bart’s public key to encrypt the symmetric key of 53.
5. Lisa sends the encrypted email and the encrypted symmetric key to Bart.
6. Bart decrypts the symmetric key with his private key.
7. He then decrypts the email with the decrypted symmetric key.
Unauthorized users who intercept the email sent by Lisa won’t be able to read it because it’s encrypted with the symmetric key. Additionally, they can’t read the symmetric key because it’s encrypted with Bart’s public key, and only Bart’s private key can decrypt it.
S/MIME
Secure/Multipurpose Internet Mail Extensions (S/MIME) is one of the most popular standards used to digitally sign and encrypt email. Most email applications that support encryption and digital signatures use S/MIME standards.
S/MIME uses RSA for asymmetric encryption and AES for symmetric encryption. It can encrypt email at rest (stored on a drive) and in transit (data sent over the network). Because S/MIME uses RSA for asymmetric encryption, it requires a PKI to distribute and manage certificates.
PGP/GPG
Pretty Good Privacy (PGP) is a method used to secure email communication. It can encrypt, decrypt, and digitally sign email. Phillip Zimmerman designed PGP in 1991, and it has gone through many changes and improvements over the years. Symantec Corporation purchased it in June 2010.
OpenPGP is a PGP-based standard created to avoid any conflict with existing licensing. In other words, users have no obligation to pay licensing fees to use it. Some versions of PGP follow S/MIME standards. Other versions follow OpenPGP standards. GNU Privacy Guard (GPG) is free software that is based on the OpenPGP standard.
Each of the PGP versions uses the RSA algorithm and public and private keys for encryption and decryption. Just like S/MIME, PGP uses both asymmetric and symmetric encryption.
Q. Bart wants to send a secure email to Lisa, so he decides to encrypt it. Bart wants to ensure that Lisa can verify that he sent it. Which of the following does Lisa need to meet this requirement?
A. Bart’s public key
B. Bart’s private key
C. Lisa’s public key
D. Lisa’s private key
Answer is A. Lisa would decrypt the digital signature with Bart’s public key and verify the public key is valid by querying a Certificate Authority (CA). The digital signature provides verification that Bart sent the message, non-repudiation, and integrity for the message.
Bart encrypts the digital signature with his private key, which can only be decrypted with his public key.
Lisa’s keys are not used for Bart’s digital signature, but might be used for the encryption of the email.
Although not part of this scenario, Bart would encrypt the email with Lisa’s public key and Lisa would decrypt the email with Lisa’s private key.
See Chapter 10 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide for more information on using cryptographic protocols.