There are times when you want to ensure that email messages are only readable by authorized users and encrypting email is the solution. Just as any other time you use encryption, encrypting an email provides confidentiality. If you’re planning on taking the Security+ exam, you should have a good understanding of encrypting email.
For example, can you answer this question?
Q. Bart wants to send a secure email to Lisa so he decides to encrypt it. Bart wants to ensure that Lisa can verify that he sent it. Which of the following does Lisa need to meet this requirement?
A. Bart’s public key
B. Bart’s private key
C. Lisa’s public key
D. Lisa’s private key
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Encrypting Email with Only Asymmetric Encryption
Imagine that Lisa wants to send an encrypted message to Bart. The following steps provide a simplified explanation of the process if only asymmetric encryption is used:
- Lisa retrieves a copy of Bart’s certificate that contains his public key.
- Lisa encrypts the email with Bart’s public key.
- Lisa sends the encrypted email to Bart.
- Bart decrypts the email with his private key.
This works because Bart is the only person who has access to his private key. If attackers intercepted the email, they couldn’t decrypt it without Bart’s private key. With this in mind, it’s important to remember that when you’re encrypting email contents, the recipient’s public key encrypts and the recipient’s private key decrypts. The sender’s keys are not involved in this process. In contrast, a digital signature only uses the sender’s keys but not the recipient’s keys.
In most cases, the public key doesn’t actually encrypt the message, but instead encrypts a symmetric key used to encrypt the email. The recipient then uses the private key to decrypt the symmetric key, and then uses the symmetric key to decrypt the email.
Remember this
The recipient’s public key encrypts when encrypting an email message and the recipient uses the recipient’s private key to decrypt an encrypted email message.
Encrypting Email with Asymmetric and Symmetric Encryption
The previous description provides a simplistic explanation of email encryption used by some email applications. However, most email applications combine both asymmetric and symmetric encryption. Asymmetric encryption is slow and inefficient, but symmetric encryption is very quick.
Instead of using only symmetric encryption, most email applications use asymmetric encryption to privately share a session key. They then use symmetric encryption to encrypt the data. For example, imagine that Lisa is sending Bart an encrypted message. Figure 1 shows the process of encrypting the message and the symmetric key.
Figure 1: Encrypting email
- Lisa identifies a symmetric key to encrypt her email. For this example, assume it’s a simplistic symmetric key of 53, though a symmetric algorithm like AES would use 128-bit or larger keys.
- Lisa encrypts the email contents with the symmetric key of 53.
- Lisa retrieves a copy of Bart’s certificate that contains his public key.
- She uses Bart’s public key to encrypt the symmetric key of 53.
- Lisa sends the encrypted email and the encrypted symmetric key to Bart.
- Bart decrypts the symmetric key with his private key.
- He then decrypts the email with the decrypted symmetric key.
Figure 2 shows the process of sending the encrypted message and encrypted session key, and identifies how the recipient can decrypt the data:
Figure 2: Decrypting email
Unauthorized users who intercept the email sent by Lisa won’t be able to read it because it’s encrypted with the symmetric key. Additionally, they can’t read the symmetric key because it’s encrypted with Bart’s public key, and only Bart’s private key can decrypt it.
So, can you answer this sample question?
Q. Bart wants to send a secure email to Lisa so he decides to encrypt it. Bart wants to ensure that Lisa can verify that he sent it. Which of the following does Lisa need to meet this requirement?
A. Bart’s public key
B. Bart’s private key
C. Lisa’s public key
D. Lisa’s private key
Answer is A. Lisa would decrypt the digital signature with Bart’s public key and verify the public key is valid by querying a Certificate Authority (CA). The digital signature provides verification that Bart sent the message, non-repudiation, and integrity for the message.
Bart encrypts the digital signature with his private key, which can only be decrypted with his public key.
Lisa’s keys are not used for Bart’s digital signature, but might be used for the encryption of the email.
Although not part of this scenario, Bart would encrypt the email with Lisa’s public key and Lisa would decrypt the email with Lisa’s private key.
