Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

COSC362 > Lecture 20: Email security > Flashcards

Lecture 20: Email security Flashcards

1
Q

What are the two types of link security?

A

DKIM

STARTTLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two types of end-to-end security?

A

PGP

S/MIME

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does DKIM stand for?

A

Domain Keys Identified Mail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does S/MIME stand for?

A

Secure/Multipurpose Internet Mail Extension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does SMTP stand for?

A

Single message transfer protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is SMTP?

A

a mail transmission protocol to send an email from a source to a destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are POP and IMAP?

A

mail access protocols to allow a message user agent (MUA) to download an email from a message transfer agent (MTA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does MUA stand for?

A

message user agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does MTA stand for?

A

message transfer agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the MUA do?

A

connects a client to a mail system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the MUA when using SMTP?

A

to send a mail to a message submission agent (MSA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a MSA?

A

message submission agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the MUA do when using POP or IMAP?

A

to retrieve the mail from the message store (MS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does MS stand for?

A

message store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does MHS stand for?

A

message handling system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the MHS do?

A

transfers a message from MSA to MS via one or more message transfer agents(MTAs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Give the diagram for the architecture i.t.o email security requirements

IMPORTANT

A

See slide 7 in set 20

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Comment on potential security threats i.t.o email security

A

Considering threats in the usual CIA categories

  • -> Email content may require confidentiality and/or authentication
  • -> Email service availability may be threatened

Metadata in the header is a significant source of information for an attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is spam?

A

Unsolicited bulk email (UBE)

A cheap form of advertising?

Common vector for phishing attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What do countermeasures of span typically use?

A

email filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Comment on the proposals to implement proof of work for preventing spam

A

The email sender must solve a moderately hard puzzle in order to have the mail accepted into MHS

e.g. Hashcash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What kind of basis is security provided between different agents in the mail system on? What protocols are used?

A

link-by-link basis

STARTTLS and DKIM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What kind of basis is security provided from client to client in the mail system on? What protocols are used?

A

end-to-end basis

PGP and S/MIME

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In terms of link and end-to-end security, what is the ideal situation?

A

both are used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What standard is DKIM in?
RFC 6376 (2011)
26
What does DKIM allow?
the sending mail domain to sign an outgoing mail using RSA signatures
27
What can verify the origin of mail in DKIM?
receiving domain
28
What uses DKIM?
Widely used by prominent email providers, including Gmail
29
What does DKIM help to prevent?
email spoofing, and so to reduce spams and phishing
30
What is the public key of the sending domain retrieved using in DKIM?
a DNS
31
What does DNS stand for?
domain name system
32
What does STARTTLS extend?
Extending mail protocols SMTP, POP an IMAP to run over TLS connections
33
What type of security does STARTTLS provide?
link-by-link security, but not end-to-end security
34
What is opportunistic TLS?
extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate port for encrypted communication
35
What type of use of TLS encryption security is STARTTLS?
opportunistic
36
What standard is IMAP and POP3 in?
RFC 2595
37
What standard is SMTP in?
RFC 3207
38
What uses STARTTLS?
prominent email providers, including Gmail and Microsoft Outlook
39
What is STARTTLS vulnerable to?
STRIPTLS attacks
40
What happens in a STRIPTLS attack?
An attacker interrupts TLS negotiation, and connection falls back to plaintext transmission
41
What is PGP?
Pretty Good Privacy (PGP) is an encryption system used for both sending encrypted emails and encrypting sensitive files
42
What does PGP protect?
mail message contents
43
Explain the hybrid encryption in PGP
1) A new random “session key” is generated for each message | 2) The session key is encrypted with the long-term public key of the recipient
44
What is used for signing in PGP?
RSA or DSA
45
Is compression used in PGP?
Yes, with Zip
46
What is the coding used in PGP? Why?
Coding using radix-64 to ensure that binary strings can be sent in the mail body
47
Comment on the encryption of session keys in PGP **IMPORTANT**
encrypted using asymmetric encryption --> OpenPGP requires the support of Elgamal encryption and recommends the support of RSA encryption
48
Comment on the encryption of message content in PGP **IMPORTANT**
encrypted using symmetric encryption --> OpenPGP requires the support of 3DES with 3 keys (168bits in total) and recommends the support of AES-128 andCAST5 (other algorithms are also defined)
49
When is compression applied in PGP?
before encryption
50
Can encryption be applied independently of signing in PGP?
Yes
51
Why can encryption be applied independently of signing in PGP?
no requirement for authenticated encryption
52
Comment on the signing of plaintext messages in PGP
Optionally signed with the sender's private key --> OpenPGP standard requires the support of RSA signatures and recommends the support of DSA signatures
53
In PGP, what are RSA-signed messages hashed with?
SHA1 (in the standard) or with SHA2 hash functions
54
In PGP, in a web of trust, who generates the users' public/private key pairs?
The users generate their own public/private keys pairs
55
In PGP, in a web of trust, what are the public keys available on?
distributed key servers
56
In PGP, in a web of trust, who can signed another user's public key?
Any PGP user, indicating their level of trust
57
Who can revoke a user's key? How?
The user, by signing a revocation certificate with the revoked key --> users can also decide on the key expiration date when generating it
58
Comment on the PGP uptake
Around 100 keys added per day on SKS keyserver pool Growth rate remains linear over past several years Around 60,000 keys in the strong set of keys with a trust path between any pair of keys
59
What are the 3 main OpenPGP critisms
1) outdated cryptographic algorithms still used - -> SHA1, CAST5, etc 2) No support for SHA3 and authenticated encryption (e.g. GCM) 3) Lots of metadata available to eavesdropper - -> file length - -> used encryption algorithms - -> recipient key identity
60
What are the similar features S/MIME have to PGP?
Authentication, integrity, non-repudiation (signature) and confidentiality (encryption) of the message body carried in SMTP messages
61
Comment on the message format used in S/MIME
Different, not interoperable message format
62
What is included in each message in S/MIME? Why?
Sender’s public key Used to verify the message
63
What are used instead of Web of Trust in S/MIME?
X.509 certificates issued by CAs
64
Which does NIST recommend, S/MIME or PGP? Why?
S/MIME rather than PGP because of greater confidence in CA system (compared to Web of Trust)
65
Who supports S/MIME?
most popular mail clients
66
Explain the authentication process in S/MIME **IMPORTANT**
See slide 26 in set 20
67
What are the four guarantees of S/MIME? **IMPORTANT**
1) RSA guarantee 2) SHA-256 guarantee 3) Public key encryption 4) One-time mechanism
68
Explain the authentication process in S/MIME **IMPORTANT**
See slide 28 in set 20
69
Outline the RSA guarantee of S/MIME
R assured that only the owner of the private key can generates
70
Outline the SHA-256 guarantee of S/MIME
R assured that no one else could generate a new digest that matches that h(m), and a signature of m
71
Outline the public key encryption guarantee of S/MIME
``` No session (content-encryption) key distribution needed Only R can recover k ```
72
Outline the one-time mechanism guarantee of S/MIME
Symmetric encryption approach is strengthened
73
What is the benefit of combining symmetric cryptography and public key cryptography in S/MIME?
allows to reduce encryption time

COSC362 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions