RE: integrity and mail encryption

From: Adrian Floarea (adrian.floarea_at_uti.ro)
Date: 10/31/05

  • Next message: Austin Murkland: "Re: Wireless security question..." 
    To: <b.hines@comcast.net>, "'Juan B'" <juanbabi@yahoo.com>, "'security basics'" <security-basics@securityfocus.com>
Date: Mon, 31 Oct 2005 23:17:52 +0200

    Yes, you are right. Anyway, there are a lot of security products free (like
    PGP) or not free which offer a better security like Outlook. But, I
    understand that Juan wants a simple solution and with no cost. For the
    certificate and private key, he can use the certificate authority from
    Windows Server (2000 and 2003) or Open SSL (both free). For strong security,
    he can use also a smart card.

    But you know, you can keep the things simple or not :D.

    Regards,

    Adi Floarea

    -----Original Message-----
    From: b.hines@comcast.net [mailto:b.hines@comcast.net]
    Sent: Monday, October 31, 2005 11:07 PM
    To: adrian.floarea@uti.ro; 'Juan B'; 'security basics'
    Cc: Adrian Floarea
    Subject: RE: integrity and mail encryption

    Adrian,

    Exactly, but I believe you do however need to generate a certificate
    public/private key pair to associate with a unique mail account. By using
    the senders public key, (or signing the mail), the recipient can encrypt a
    return mail with thier own private key and the sender's public key. The
    original sender can then decrypt the mail (given they have the original
    recipients public key from a previously signed mail). The key pair works on
    the premise that the private key is unique to the owner and not shared and
    the public key of the pair is a back door to allow a reverse hash of a
    private key encryption in timely manner. By using a Diffie Helman key
    exchange with an associated private key of say 256 bit AES or 128 bit 3DES
    encryption the message is very secure, this method provides non-repudiation
    (Accountability) and Mail signing hash (Integrity) and strong private key
    encryption (Confidentiality).

    Bob

    >
    > Hi Juan,
    >
    > You don't need any free tool. Outlook already knows to sign (for
    > integrity) and encrypt the messages according with S/MIME standard. As
    > far as I know you, Yahoo does not know S/MIME. If your message is only
    > signed with detached signature (like Outlook does), you can view' it in
    Yahoo.
    >
    > More details you can find on this link
    > www.dartmouth.edu/~deploypki/materials/modules/using/smime/outlook.doc.
    >
    > Security Product Team Leader
    > Adrian Floarea, CISA
    > Bucharest, Romania
    > Email: adrian.floarea@uti.ro
    >
    >
    > -----Original Message-----
    > From: Juan B [mailto:juanbabi@yahoo.com]
    > Sent: Saturday, October 29, 2005 11:52 PM
    > To: security basics
    > Subject: integrity and mail encryption
    >
    > Hi,
    >
    > I want to encrypt and check integrity of mail between two outlook
    > clients, does anyone knows about such a free tool?
    >
    > and what doing the same between an outlook client and web mail like yahoo?
    > is it possible?
    >
    > Thanks,
    >
    > Juan
    >
    >
    >
    > __________________________________
    > Yahoo! FareChase: Search multiple travel sites in one click.
    > http://farechase.yahoo.com
    >
    >

  • Next message: Austin Murkland: "Re: Wireless security question..."

    Relevant Pages