Email Security

Question 1

What are the four main services PGP provides?

Answer 1

Pretty Good Privacy provides confidentiality, authentication, compression and compatibility.

Question 2

True or false, PGP only works on linux operation systems?

Answer 2

False, it is independent of OS.

Question 3

How does PGP authenticate?

Answer 3

Digital Signatures. SHA-1 is used to generate a 160 bit hash code. This Hash is then encrypted using RSA with the sender’s private key.

Question 4

How does PGP provide integrity?

Answer 4

With the hash code generated in the digital signature.

Question 5

Which symmetric encryption algorithms does PGP use?

Answer 5

CAST-128, IDEA or 3DES

Question 6

How many times are symmetric keys reused in PGP? How long are these keys?

Answer 6

They are not reused. For each message, a new set of symmetric keys are generated and shared. The keys are 128 bits.

Question 7

How are the keys exchanged in PGP?

Answer 7

Since the key is only used once, the symmetric key is bound to the message, and transmitted with it (after being encrypted with the receiver’s public key). There is an option to use Diffie Hellman for key exchange.

Question 8

Do we encrypt the digital signature in PGP?

Answer 8

Yes, we encrypt it with the plaintext.

Question 9

How does PGP compress what it sends? When does compression take place?

Answer 9

Using ZIP. This is done after signing, but before encrypting.

Question 10

Which algorithm does PGP use for email compatibility?

Answer 10

Radix-64

Question 11

What algorithm is S/MIME based on?

Answer 11

RSA

Question 12

What are the four S/MIME functions?

Answer 12

Enveloping data, signing data, clear-signing data, signing and enveloping data.

Question 13

What is S/MIME enveloping?

Answer 13

It involves encrypting any type of data.

Question 14

Why might we need to clear-sign data in S/MIME?

Answer 14

To allow users who don’t use S/MIME to view the message.

Question 15

Which algorithms does S/MIME use? Think about digital signatures, exchanging session keys, hashing, message encryption.

Answer 15

For digital signatures: DSS or RSA. For session key exchange: Diffie Hellman. For generating a hash for digital signatures: SHA-1. For message encryption: 3DES.

Question 16

How do PGP and S/MIME use certificates?

Answer 16

S/MIME’s trust model is based around the use of CAs, but PGP has a more anarchic trust model.

Question 17

How are message signatures verified in DKIM?

Answer 17

The receiver will verify by querying the sender’s domain directly, to obtain the appropriate public key.

Question 18

Name some problems which DKIM can address?

Answer 18

Spam emails from unknown ips. Bulk spam attackers. Email based fraud schemes.

Question 19

Which key signs a DKIM message?

Answer 19

The private key of the administrative domain from which the email originates.

Question 20

Who queries the signatures?

Answer 20

The Mail Delivery Agent at the receiver end.

Question 21

True or false, with S/MIME messages can still be secure if only one of the parties is using S/MIME?

Answer 21

False.

Question 22

True or false, DKIM is not transparent to the user, as it takes place in their Message User Agent?

Answer 22

False. It is transparent and does not take place in the user agent.

Question 23

What algorithm does DKIM use to sign?

Answer 23

RSA with SHA-256

Question 24

If Alice wants to send Bob a message with PGP, how is the session key generated?

Answer 24

Alice will generate this, and encrypt it with Bob’s public key, and append it to the message.

Question 25

Which protocol authenticates mail as coming from a certain domain?

Answer 25

DKIM

Question 26

In which protocol are clients required to authenticate themselves before submitting emails for delivery.

Answer 26

SMTP/Auth

Question 27

Which protocol authenticates an email message as coming from an organization’s authorized MTA.

Answer 27

SPF

Question 28

Which protocol publishes Information about an organization’s authorized MTAs in DNS.

Answer 28

SPF

Question 29

Which protocol ensures that email is submitted from a properly configured email client (and not a spam sending virus or open relay, for instance).

Answer 29

Smart Host

Question 30

In which protocol is outgoing email submitted via the ISP’s MTA.

Answer 30

Smart Host

Question 31

Where are PGP and S/MIME implemented?

Answer 31

In the mail user agent.

Question 32

Name one problem with SMTP?

Answer 32

There is no built in authentication. The MAIL FROM field is set by the sender, and the recipients mail server only sees the IP address of the direct peer from which it received the message.

Question 33

What is an open relay, and what might it do if it is hacked?

Answer 33

An open relay will forward SMTP messages to any destination. Normally, they will add the correct “RECEIVED” header revealing the IP source of the message, but a hacked one might not.

Question 34

Why might spammers want to hide the source of their mail?

Answer 34

To avoid blacklists. This is why they often use botnets.

Question 35

Name and describe some measures against spam.

Answer 35

Blacklisting dodgy IP addresses.
Greylisting new senders.
Use smart hosts, which do not allow outgoing traffic from their customers to port 25, and instead they must use their ISPs SMTP relay to send outgoing mail.
Use SMTP-auth, where the sender is required to authenticate first.
Use POP before SMTP, where you must check for incoming mail, before sending.