Email Encryption and Digital Signatures

In order to protect the contents of your email you can :

• Encrypt it.- This makes the content unreadable so that to anyone viewing the email it is just gibberish.

• Sign it- This allows the recipient to be confident that it was you who sent the message and that the message hasn't been changed.

Both process require the use of keys. This keys are simply numbers (128 bit being common) that are then combined with the message using a particular method (algorithm-  RSA) to either encrypt or sign the message.

Symmetrical Keys and Public and Private Keys

Almost all encryption methods in use today employ public and private keys. These are considered much more secure than the old symmetrical key arrangement.

With a symmetrical key a key is used to encrypt or sign the message and the same key is used to decrypt the message. This is the same as the keys (door, car keys) we deal with in everyday life. The problem with this type of key arrangement is if you lose the key anyone who finds it can unlock your door.

With Public and Private keys toe keys are used that are mathematically related (they belong as a key pair) but are different. This means a message encrypted with a public key cannot be decrypted with the public key.

To decrypt the message you require the private key. If this type of key arrangement were used with you car keys you could lock the car and leave the key in the lock as the same key cannot unlock the car.

This type of key arrangement is very secure and is used in all modern encryption/signature systems.

Sending Encrypted Email

Consider two users user A and User B. User A wants to send an encrypted email to user B. To do this User A requires the Public key of User B. So how does User A obtain this key?

Well because the key is public it can be sent to him in a email, posted on a website, forwarded from someone else. It makes no difference to user B who actually has it as it is public.

So User A uses the public key fro user B to encrypt the mail message when user B receives the message he decrypts it using the Private key. I anyone else sees the message they can't read it as they don't have the private key only the public.

Digital Signatures

Digital signatures use the same public/private key technology as digital encryption. The keys are again generates as a key pair and are used to sign and verify an email signature.

Signing a Message

Again using User A and User B as an example. User A signs an email with his private signature key and sends the message . User B opens the message and can verify the signature by using the user A public signature key which , because it is public can actually be sent ( and is ) with the email.

Digital Certificates and Key Exchange

We have repeated said the because public keys are public they can be freely sent around the Internet and used. The problem is how do you know they are genuine.

How do you know that the public key you are using belongs to User B. This is the role of digital certificates. The certificate is used to guarantee the authenticity of the public Key.

It serves the same purpose as a passport does in everyday life.

Obtaining A digital Certificate

You get a digital certificate from a recognised Certificate authority. Just like you get a passport from a passport office. In fact the procedure is very similar.

You fill out the appropriate forms add your public keys (they are just numbers) and send it/them to the certificate authority. The certificate authority does some checks ( depends on authority) and the send you back the keys enclosed in a certificate.

The certificate is signed by the Issuing Certificate authority and this it what guarantees the keys. Now when someone wants you keys you send them the certificate they verify the signature on the certificate and if it verifies then they can trust your keys.

Certificates cost money normally but there are a few companies that offer them free for non- commercial use:

• Comodo group
• Verisign offer free trial
• Microsoft office have more complete list