Re: E-mail encryption. Is this right? Isn't it a security hole?
From: Michel Gallant (MVP) (neutron@istar.ca)
Date: 10/10/02
- Next message: Jerry Bryant [MS]: "Mail from Microsoft with attachments"
- Previous message: Darryl: "pop ups"
- In reply to: Microsoft: "E-mail encryption. Is this right? Isn't it a security hole?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 10 Oct 2002 10:38:02 -0400 From: "Michel Gallant (MVP)" <neutron@istar.ca>
as a further comment on security in general, read the **Conclusion** section
of this white paper on .net security:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/net/evaluate/fsnetsec.asp
The concepts translate into almost any area of technology security.
Regarding protecting your private keys, a good model is to never store your
private keys on a local computer (even if you don't use smartcard tech.). Use
your keys (email, codesigning whatever), then export as pfx and back-up, and
save in a few different secure locations. Import the pfx as needed, or better yet,
use CAPICOM 2 and use the pfx file directly off the removeable medium.
Some very useful info. on this in Win2000 ResKit docs.
- Michel Gallant MVP Security
Microsoft wrote:
> When I send an encrypted e-mail I use the receivers public key to achieve
> the encryption.
>
> When the receiver reads the encrypted e-mail uses his/her private key.
>
> If the receivers certificate is revoked then the sender gets an error
> message when trying to encrypt the e-mail. Obviously the senders client
> reads the CRL (Certificate Revocation List) from the Certificates CDP
> (Certificate Revocation List Distribution Point). That's right!!!
>
> But look what happens in another situation.
>
> If receivers certificate has been revoked after the sender has sent the
> encrypted e-mail, then the receiver can read the encrypted e-mail, by using
> the revoked certificate as it was a valid one.
>
> So suppose that someone gets my private key (smart card - PIN) and succeeds
> to read my mailbox. Then he/she can read my encrypted e-mails. Even If i
> revoke my certificate I can't stop him/her from reading my encrypted
> e-mails.
>
> That happens because when the receiver tries to read the encrypted e-mail
> the mail client ignores the CRL.
>
> Is this right? Isn't it a security hole?
- Next message: Jerry Bryant [MS]: "Mail from Microsoft with attachments"
- Previous message: Darryl: "pop ups"
- In reply to: Microsoft: "E-mail encryption. Is this right? Isn't it a security hole?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
