Secure Email

COMP211 Lectures 2021-11-29

Confidentiality

If Alice wants to send a confidential email to Bob she can do the following:

1. Generate a random symmetric private key $K_S$.
2. Encrypt the message with $K_S$ (for efficiency).
3. Also encrypt $K_S$ with Bob’s public key.
4. Send both $K_S(m)$ and $K^+_B(K_S)$ to Bob.

Bob will then:

1. Use his privaet key to decrypt and recover $K_S$.
2. Use $K_S$ to decrypt $K_S(m)$ to recover $m$.

Integrity & Authentication

If Alice want to send $m$ to Bob, with message integrity and authentication (no encryption) we can do the following:

1. Digitally sign the hash of her message with her private key, providing integrity and authentication.
2. Send the signature and the message in the clear.

Bob can then verify the message using the technique covered in the Integrity lecture.

Confidentiality, Integrity & Authentication

To do this:

1. Complete the integrity & authentication section.
2. Pass the signature and message to the confidentiality section.
3. Send the message.

This uses three keys:

• Alice’s private key: $K^-_A$.
• Bob’s public key: $K^+_B$.
• A session symmetric key: $K_S$.

PGP (Pretty Good Privacy)

This is pretty much the same as the last method. It provides:

• Secrecy
• Authentication
• Integrity