>> We're going to wrap up about the cryptography domain.
But before we do, we're going to
talk about email cryptosystems.
Cryptosystems provide the framework for security.
One common cryptosystem is referred to as S/MIME.
That stands for Secure Multi-part
Internet Mail Exchange or Extension.
You can hear it either way.
The idea here is that when we
create a security email message,
S/MIME is standards based and
>> it uses X.509 certificates.
>> Ultimately, the way the process works is as follows.
Let me go back and show you more
of my mad PowerPoint skills.
Okay. Let's talk about an email message.
When I send an email message,
I want it to be secure.
The first thing I think about doing
is that I create the contents.
Now, we'd want to encrypt
the message contents with symmetric cryptography,
because this could end up being a large amount of
data and symmetric cryptography is faster.
So it needs to be encrypted with symmetric key.
But here's the problem.
How do I get the shared key to the receiver?
I have to figure out a way till
the securely is distributed.
So what I do is I put
that symmetric key right on the message.
But if I do that and someone
>> else intercepts the message,
>> they can get my symmetric-key.
So I will encrypt that symmetric key
using a key I have from the receiver.
Now, which key do you think I have in the receiver?
I have the receiver's public key,
and I use that to encrypt
my symmetric key. What have I just done?
Use symmetric key exchange.
I also need to make sure that
the receiver knows the message has
not been modified in transit,
so I put a hash on the message.
Of course, the whole purpose of
a hash is to guarantee integrity.
What's the last thing I'm going to do?
How do I make sure the receiver is going to know who
that message comes from and that it comes from me?
Well, the way it works is
that the hash is encrypted with
the sender's private key
and that provides non-repudiation.
It's also called a digital signature.
We see here is the creation of a digital envelope
via S/MIME and everything follows the standards.
Breaking from the standards,
we have another email cryptosystem called
PGP, Pretty Good Privacy.
I love that name. Is developed
by a gentleman named Phil Zimmerman.
He was really strong in the privacy camp.
He proposed that the government would like to decrypt
anything that was encrypted, and that's true.
But Zimmerman asked why we were all
using these algorithms and standards provided
by the government if the government was going to be
so untrustworthy in relation to the cryptography.
Why wouldn't we use our own?
Zimmerman created the email application,
PGP, and he developed
his own encryption algorithm to support PGP.
That algorithm is called IDEA,
Internet Data Encryption Algorithm.
PGP doesn't use X.509 certificates.
It uses its own certificates and users
sign each other's certificates in
what turns out to be a Web Of Trust.
If you trust Mark and Mark trust Sally,
then you trust Sally. It works that way.
Also, instead of logging in with passwords,
users use passphrases and those are much more
secure than the eight-character passwords
review traditionally.
The downside is that it's proprietary.
You have to download special software to use it,
but it does provide an alternative to S/MIME.
To recap, we have S/MIME as
the standards-based email application and we have
PGP as a proprietary email application
using IDEA and a Web Of Trust.