Electronic Mail Security

1.     What are the five principal services provided by PGP?

Ans: Authentication, Confidentiality, Compression, E-mail Compatibility and Segmentation

2.     What is the utility of a detached signature?

Ans: A detached signature is useful in several contexts. A user may wish to maintain a separate signature log of all messages send or received. A detached signature of an executable program can detect subsequent virus infection. Finally, detached signature can be used when more than one party must sign document, such as a legal contact. Each person’s signature is independent and therefore is applied only to the document. Otherwise, signature have to be nested, with the second signer signing both the document and the first signature, and so on.

3.     Why does PGP generate a signature before applying compression?

Ans: a. It is preferable to sign an uncompressed message so that one can store only the uncompressed message together with the signature for future verification. If one signed a compressed document, then it would be necessary either to store a compressed version of the message for later verification or to recompress the message when verification is required. b. Even if one were willing to generate dynamically a recompressed message for verification, PGP's compression algorithm presents a difficulty. The algorithm is not deterministic; various implementations of the algorithm achieve different tradeoffs in running speed versus compression ratio and, as a result, produce different compressed forms. However, these different compression algorithms are interoperable because any version of the algorithm can correctly decompress the output of any other version. Applying the hash function and signature after compression would constrain all PGP implementations to the same version of the compression algorithm.

4.     What is R64 conversion?

Ans: R64 converts a raw 8-bit binary stream to a stream of printable ASCII characters. Each group of three octets of binary data is mapped into four ASCII characters.

5.     Why is R64 conversion useful for an e-mail application?

Ans: E-mail facilities often are restricted to maximum message length.

6.     How does PGP use the concept of trust?

Ans: PGP includes a facility for assigning a level of trust to individual signers and to keys.

7.     What is RFC 5322?

Ans: RFC5322 defines a format for text messages that are sent using electronic mail.

8.     What is MIME?

Ans: MIME is an extension to the RFC 822 framework that is intended to address some of the problems and limitations of the use of SMTP (Simple Mail Transfer Protocol) or some other mail transfer protocol and RFC 822 for electronic mail.

9.     What is S/MIME?

Ans: S/MIME (Secure/Multipurpose Internet Mail Extension) is a security enhancement to the MIME Internet e-mail format standard, based on technology from RSA Data Security.

10.  What is DKIM?

NOTE: When PGP is used, at least part of the block to be transmitted is encrypted. If only the signature service is used, then the message digest is encrypted (with the sender's private key). If the confidentiality service is used, the message plus signature (if present) are encrypted (with a one-time symmetric key). Thus, part or all of the resulting block consists of a stream of arbitrary 8-bit octets. However, many electronic mail systems only permit the use of blocks consisting of ASCII text.