File Downloaded From www.Bustudymate.

in

UNIT - V

PGP and S/MIME

Cryptography & Network Security - Behrouz
1
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Objectives
 To explain the general structure of an e-mail
application program
 To discuss how PGP can provide security services
for e-mail
 To discuss how S/MIME can provide security
services for e-mail
 To define trust mechanism in both PGP and
S/MIME
 To show the structure of messages exchanged in
PGP and S/MIME
Cryptography & Network Security - Behrouz
2
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

16--1 E
16 E--MAIL

Let us first discuss the electronic mail (e

(e--mail) system in
general
general..

Topics discussed in this section:

16.1.1 E-mail Architecture
16.1.2 E-mail Security
Cryptography & Network Security - Behrouz
3
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.1.1 E-mail Architecture

Figure 16.1 E-mail architecture

Cryptography & Network Security - Behrouz

4
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.1.2 E-mail Security

Cryptographic Algorithms

Note
In e-mail security, the sender of the message needs to
include the name or identifiers
of the algorithms used in the message.

Certificates
It is obvious that some public-public-key algorithms must be
used for e-mail security.
security .
Cryptography & Network Security - Behrouz
5
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.1.2 Continued

Cryptographic Secrets

Note
In e-mail security, the encryption/decryption is done
using a symmetric-key algorithm,
but the secret key to decrypt the message is encrypted
with the public key of the
receiver and is sent with the message.

Cryptography & Network Security - Behrouz

6
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

16--2 PGP
16

Pretty Good Privacy (PGP) can be used to create a

secure e-mail message or to store a file securely for
future retrieval.
retrieval.

One of the protocols to provide security at the

application layer is Pretty Good Privacy (PGP)
(PGP)..

PGP is designed to create authenticated and

confidential e-mails
mails..
Cryptography & Network Security - Behrouz
7
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.19 Position of PGP in the TCP/IP protocol suite

Cryptography & Network Security - Behrouz

8
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.1 Scenarios

Plaintext

Figure 16.2 A plaintext message

Cryptography & Network Security - Behrouz

9
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.1 Continued

Message Integrity

Figure 16.3 An authenticated message

Cryptography & Network Security - Behrouz

10
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.1 Continued

Compression

Figure 16.4 A compressed message

Cryptography & Network Security - Behrouz

11
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.20 A scenario in which an e-mail message is

authenticated and encrypted

Cryptography & Network Security - Behrouz

12
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
PGP Services

Confidentiality with One

One--Time Session Key

Figure 16.5 A confidential message

Cryptography & Network Security - Behrouz

13
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.1 Continued

Code Conversion
Another service provided by PGP is code conversion
conversion..
PGP uses Radix
Radix--64 conversion.
conversion.

Segmentation
PGP allows segmentation of the message.
message.

Cryptography & Network Security - Behrouz

14
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.2 Continued

PGP Algorithms

Cryptography & Network Security - Behrouz

15
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.2 Continued

Cryptography & Network Security - Behrouz

16
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.2 Continued

Cryptography & Network Security - Behrouz

17
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.2 Continued

Cryptography & Network Security - Behrouz

18
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.3 PGP Certificates

X.509 Certificates
Protocols that use X.509 certificates depend on the
hierarchical structure of the trust.
trust.

Note
In X.509, there is a single path from the fully trusted
authority to any certificate.

Cryptography & Network Security - Behrouz

19
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.3 Continued

PGP Certificates
In PGP, there is no need for CAs
CAs;; anyone in the ring can
sign a certificate for anyone else in the ring.
ring.
Note
In PGP, there can be multiple paths from fully or
partially trusted authorities to any subject.

Trusts and Legitimacy

The entire operation of PGP is based on introducer
trust,, the certificate trust,
trust trust, and the legitimacy of the
public keys.
keys.
Cryptography & Network Security - Behrouz
20
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.4 Key Revocation

It may become necessary for an entity to revoke his or

her public key from the ring
ring.. This may happen if the
owner of the key feels that the key is compromised
(stolen, for example) or just too old to be safe
safe..

Cryptography & Network Security - Behrouz

21
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 PGP Packets

Figure 16.12 Format of packet header

Cryptography & Network Security - Behrouz

22
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
Types of PGP Packet

Cryptography & Network Security - Behrouz

23
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
Types of PGP Packet

Figure 16.13 Literal data packet

Cryptography & Network Security - Behrouz

24
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Figure 16.14 Compressed data packet

Cryptography & Network Security - Behrouz

25
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Figure 16.15 Encrypted data packet

Cryptography & Network Security - Behrouz

26
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Figure 16.16 Signature packet

Cryptography & Network Security - Behrouz

27
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Cryptography & Network Security - Behrouz

28
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Figure 16.17 Session-key packet

Cryptography & Network Security - Behrouz

29
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Figure 16.18 Public-key packet

Public Key

Cryptography & Network Security - Behrouz

30
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.6 Continued

Figure 16.19 User ID packet

Cryptography & Network Security - Behrouz

31
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.7 PGP Messages

Figure 16.20 Encrypted message

Cryptography & Network Security - Behrouz

32
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.7 Continued

Figure 16.21 Signed message

Cryptography & Network Security - Behrouz

33
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.2.7 Continued

Figure 16.22 Certificate message

Cryptography & Network Security - Behrouz

34
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

16--3 S/MIME
16

Another security service designed for electronic mail is

Secure/Multipurpose Internet Mail Extension
(S/MIME)
(S/MIME).. The protocol is an enhancement of the
Multipurpose Internet Mail Extension (MIME) protocol
protocol..

Topics discussed in this section:

16.3.1 MIME
16.3.2 S/MIME
16.3.3 Applications of S/MIME
Cryptography & Network Security - Behrouz
35
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Figure 16.23 MIME

Cryptography & Network Security - Behrouz

36
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Figure 16.24 Teledesic

Cryptography & Network Security - Behrouz

37
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

MIME
MIME--Version
This header defines the version of MIME used.
used. The
current version is 1.1.

Content-
Content-Type
The content type and the content subtype are separated
by a slash
slash.. Depending on the subtype, the header may
contain other parameters
parameters..

Cryptography & Network Security - Behrouz

38
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Cryptography & Network Security - Behrouz

39
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Cryptography & Network Security - Behrouz

40
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Figure 16.25 Radix-64 conversion

Cryptography & Network Security - Behrouz

41
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Cryptography & Network Security - Behrouz

42
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.1 Continued

Figure 16.26 Quoted-printable

Cryptography & Network Security - Behrouz

43
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.2 S/MIME

S/MIME adds some new content types to include

security services to the MIME.
MIME. All of these new types
include the parameter “application/pkcs
“application/pkcs7
7-mime,” in
which “pkcs” defines “Public Key Cryptography
Specification..”
Specification

Cryptographic Message Syntax (CMS)

To define how security services, such as confidentiality
or integrity, can be added to MIME content types,
S/MIME has defined Cryptographic Message Syntax
(CMS).
(CMS). The syntax in each case defines the exact
encoding scheme for each content type
type..
Cryptography & Network Security - Behrouz
44
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.2 Continued

Figure 16.27 Signed-data content type

Cryptography & Network Security - Behrouz

45
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.2 Continued

Figure 16.28 Enveloped-data content type

Cryptography & Network Security - Behrouz

46
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.2 Continued

Figure 16.29 Digest-data content type

Cryptography & Network Security - Behrouz

47
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.2 Continued

Figure 16.30 Authenticated-data content type

Cryptography & Network Security - Behrouz

48
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in
16.3.2 Continued

Cryptographic Algorithms
S/MIME defines several cryptographic algorithms
algorithms.. The
term “must
must”
” means an absolute requirement;
requirement; the term
“should”
should” means recommendation.
recommendation.

Cryptography & Network Security - Behrouz

49
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Security in the
Internet:
IPSec, SSL/TLS,
PGP,
VPN, and Firewalls 31.50

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.1 Common structure of three security protocols

Cryptography & Network Security - Behrouz

51
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

32--1 IPSecurity (IPSec)

32

IPSecurity (IPSec) is a collection of protocols designed

by the Internet Engineering Task Force (IETF) to
provide security for a packet at the network level.
level.

Topics discussed in this section:

Two Modes
Two Security Protocols
Security Association
Internet Key Exchange (IKE)
Virtual Private Network
Cryptography & Network Security - Behrouz
52
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.2 TCP/IP protocol suite and IPSec

Cryptography & Network Security - Behrouz

53
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.3 Transport mode and tunnel modes of IPSec protocol

Cryptography & Network Security - Behrouz

54
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Note
IPSec in the transport mode does not protect the IP header; it only protects the
information coming from the transport layer.

Cryptography & Network Security - Behrouz

55
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.4 Transport mode in action

Cryptography & Network Security - Behrouz

56
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.5 Tunnel mode in action

Cryptography & Network Security - Behrouz

57
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Note
IPSec in tunnel mode protects the original IP header.

Cryptography & Network Security - Behrouz

58
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.6 Authentication Header (AH) Protocol in transport mode

Cryptography & Network Security - Behrouz

59
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Note
The AH Protocol provides source authentication and data integrity,
but not privacy.

Cryptography & Network Security - Behrouz

60
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.7 Encapsulating Security Payload (ESP) Protocol in transport mode

Cryptography & Network Security - Behrouz

61
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Note
ESP provides source authentication, data integrity, and privacy.

Cryptography & Network Security - Behrouz

62
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Table 32.1 IPSec services

Cryptography & Network Security - Behrouz

63
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.8 Simple inbound and outbound security associations

Cryptography & Network Security - Behrouz

64
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Note
IKE creates SAs for IPSec.

Cryptography & Network Security - Behrouz

65
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.9 IKE components

Cryptography & Network Security - Behrouz

66
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Table 32.2 Addresses for private networks

Cryptography & Network Security - Behrouz

67
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.10 Private network

Cryptography & Network Security - Behrouz

68
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.11 Hybrid network

Cryptography & Network Security - Behrouz

69
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.12 Virtual private network

Cryptography & Network Security - Behrouz

70
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.13 Addressing in a VPN

Cryptography & Network Security - Behrouz

71
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

32--2 SSL/TLS
32

Two protocols are dominant today for providing security

at the transport layer:
layer: the Secure Sockets Layer (SSL)
Protocol and the Transport Layer Security (TLS)
Protocol.
Protocol. The latter is actually an IETF version of the
former.
former.
Topics discussed in this section:
SSL Services
Security Parameters
Sessions and Connections
Four Protocols
Transport Layer Security
Cryptography & Network Security - Behrouz
72
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.14 Location of SSL and TLS in the Internet model

Cryptography & Network Security - Behrouz

73
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Table 32.3 SSL cipher suite list

Cryptography & Network Security - Behrouz

74
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Table 32.3 SSL cipher suite list (continued)

Cryptography & Network Security - Behrouz

75
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Note
The client and the server have six different cryptography secrets.

Cryptography & Network Security - Behrouz

76
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.15 Creation of cryptographic secrets in SSL

Cryptography & Network Security - Behrouz

77
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.16 Four SSL protocols

Cryptography & Network Security - Behrouz

78
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.17 Handshake Protocol

Cryptography & Network Security - Behrouz

79
A. Forouzan

File Downloaded From www.Bustudymate.in

 File Downloaded From www.Bustudymate.in

Figure 32.18 Processing done by the Record Protocol

Cryptography & Network Security - Behrouz

80
A. Forouzan

File Downloaded From www.Bustudymate.in