1 Dec 1995 02:31
Re: Secure EMail, How?
Keith Moore <moore <at> cs.utk.edu>
1995-12-01 01:31:14 GMT
1995-12-01 01:31:14 GMT
> How can I send and receive email securely without any end user > complexity? Unfortunately, that's sort of like asking how to make pigs fly. First of all, what do you mean by "secure"? Whom do you trust not to snoop on your data or try to change it as it goes by? The Internet? (probably not) Your local network? The local network at the other end of the connection? You have to evaluate your level of trust for every element in the path that handles unencrypted data. Do you trust the user's PC? How do you make sure nobody else is using it? How do you make sure that nobody has modified the software on it, (either directly or due to infection by some virus) to compromise the encryption program or the encrypted data? (this is equivalent to asking "How do you stop users from installing ANY outside software on their PCs?") How do you know the user is who he says he is? Do you store a secret on a file on his disk that the user must possess before you believe him? How do you keep someone else with access to that PC (or a virus writer) from getting that secret or changing it so that the user cannot access his bank account? What happens if the user's files (containing this secret) get copied to some other machine? If you store the secrets or the encryption software on a file server, how does the PC authenticate itself to the file server? (And how does the file server authenticate itself to the PC?)(Continue reading)
RSS Feed