An email message can be divided into two parts, the header and the body. The header section contains information such as the sender of the message, the recipients, and the subject. This information is necessary for the message to be routed and sent to the correct mailbox.

When a user types out a message, and sends it on his computer, he is dealing with the front end of an email system. Which is also called a Mail User Agent (MUA). (Refer to Figure 1). The MUA comes in the form of an application and provides the interface for the user to compose and send out-going messages. It may also have other features like the ability to add attachments, videos and sound. Examples of MUAs are Elm, Mailx, Zmail, and Netscape.

The MUA then passes the message on to a Mail Transport Agent (MTA), which is a routing server. The user is no longer concerned about what goes on after this although it might be of interest to system administrators. A popular MTA is Sendmail, which is used in this project. It is described more in detail in the next section. For two MTAs to understand each other, they need to support some kind of email standard protocol. A protocol is a form of communication between two hostile agents that is agreed beforehand. X.400, MHS (Mail Handling Server) and most commonly SMTP (Simple Mail Transfer Protocol), which is used on the Internet are some examples of transfer protocols. An MTA may pass the message to another MTA and so on until finally it will pass it to a Mail Delivery Agent (MDA).

Delivery Agents reside on the system and it places the message in the specified recipient’s mailbox. It will refer to a directory that contains the names of every user on a system and allows mail to be routed to the proper person’s mailbox. A common global directory standard used is X.500. However, researchers have found flaws in this standard which led to the development of another standard called Lightweight Distributed Application Protocol (LDAP) which is used in this project and will be outlined later.

The latest version of Sendmail can be downloaded free from its web site. (http://www.sendmail.org) For the project, the version used was version 8.10.1. The package downloaded came in a compressed form. To extract the files, type:

By default, all the required files will then be extracted to $HOME/sendmail.8.10.1. To compile "cd" to the sendmail/ directory and execute the following command:

In my case, the existing sendmail.cf file, which contains the configuration for Sendmail, already contains the appropriate configuration for the system. Hence, the following step was skipped. Otherwise, in the cf/cf/ directory copy the most suitable .mc file to config.mc where config can be any name. You may have to refer to cf/README for more details on tailoring the configuration file. Then run

Back up your current /etc/mail/sendmail.cf and the Sendmail binary which in this case resides in /usr/sbinThen type:

The Sendmail engine is now installed and ready to run. First, the Sendmail process needs to be woken up from the init scripts, which can be done by the following:

In order to send a message through Sendmail directly type:

where message is a file containing the message to be sent.

Encryption is the method of disguising plain text from anyone for whom it is not intended. Plain text is data that can be read and understood by the naked eye. Results of plain text that have been encrypted are called cipher text. Cipher text just looks like a jumble of unreadable characters and is incomprehensible. The process of decoding cipher text to its original plain text is called decryption.

Cryptography is the science of using mathematics to encrypt and decrypt data. This is to enable sensitive information to be stored and transmitted securely across insecure networks (like the Internet). The strength of the cryptographic algorithm used is measured in the time and resources it would require to recover the plain text without using the appropriate decoding tool. However, the strongest encryption algorithm obtainable today may not be able to hold up to tomorrow’s computing power. Therefore, claims of impenetrability may not hold in time.

A key is used together with a cryptographic algorithm to encrypt data. A key can either be a word, number or phrase. Different cipher text is produced when the same plain text is encrypted to different keys. Therefore, the security of the encrypted data depends on the strength of the cryptographic algorithm and the secrecy of the key. PGP stores the keys in encrypted form on the hard disk.

Figure 2: Private-Key encryption scheme

There are 2 types of encrypting schemes available at the moment. One is called secret-key or symmetric-key encryption, which is also the conventional cryptography. In thiscase, one key is used both for encryption and decryption (Refer to Figure 2). The benefits of this scheme is that it is very fast and it is especially useful for encrypting data that does not need to be transmitted. However, one major drawback is the distribution of this key. The sender and recipient must agree upon a key and keep it secret among them. This can prove to be difficult and inconvenient if both of them are in different geographical locations.

A second scheme called public-key encryption, which is an asymmetric scheme, solves the problem of key distribution. In this scheme, a pair of keys is used. (Refer to Figure 3.) A public key is used for encrypting the data and a corresponding private key for decryption. The public key is distributed freely while the owner keeps the private key. Anyone with a copy of the public key will then be able to encrypt information that only the owner of the corresponding private key can read. It should be noted that it is not possible to decipher the private key from the public key. The main benefit of this scheme is that no secret keys ever need to be transmitted hence largely reducing the risk of compromising secret keys. It also allows people who have no pre-existing security arrangements to exchange information securely.

PGP combines the best features of both conventional and public-key cryptography. When encryption is done using, PGP compresses the plain text first. The advantages of compression are that it speeds up modem transmission time and reduces disk space. But most importantly, it enhances security. This is because patterns in the plain text are reduced during compression. Therefore, its resistance to cryptanalysis# techniques is greatly increased.

PGP then creates a one-time-only session key to encrypt the data. This session key is generated from the random movements of the mouse and keyboard when the user types. A fast conventional encryption algorithm is use to encrypt the plain text to the session key. This results in cipher text. The session key is then encrypted to the user’s public key. This public key encrypted session key is then transmitted together with the cipher text to the recipient.

Decryption works in the reverse. The recipient’s PGP uses his private key to decrypt the temporary session key, which in turn is used to decrypt the conventionally encrypted cipher text. Using this method, PGP cryptosystem combines the speed of conventional cryptography and the convenience of public key encryption. All these are obtained without any sacrifice in security.

PGP also allows for the user of digital signatures. A digital signature serves the same purpose as a handwritten signature except that it is nearly impossible to counterfeit. By using digital signatures, the recipient of the information is able to verify the authenticity of the information’s origin and data integrity. A digital signature also provides non-repudiation, which means that it prevents the sender from claiming that he did not send the information.

A simple manner of creating digital signatures is by using the private key to encrypt the information rather than using someone else’s public key. If the message can be decrypted using the corresponding public key then it is verified that the information must have originated from the owner of the private key. However, this method can be slow and cumbersome.

An improvement would be to use a one-way hash function. PGP uses a cryptographically strong hash function on the plain text to reduce it to a fixed length data item also known as a message digest. The slightest change in the information would result in a completely difference digest. PGP would then create the signature using the digest and the private key. This digital signature together with the plain text is then sent to the recipient.

Upon receipt, the recipient uses PGP to recompute the digest thus verifying the signature. As long as a secure hash function is used, there is no way that a digital signature can be forged or the contents of the plain text tempered in any way, as this would cause the signature verification process to fail.

2.4 Installation of PGP

The version of PGP used in this project is version 6.5.1i. This is the latest version available during the course of the project. It is a freeware and the source code can be downloaded in compressed form from the international PGP web site (http://www.pgpi.org)

In the home directory do a gunzip and use the tar command to extract the files from the archive. To compile, go to the top-level directory of the PGP source code, which in this case is $HOME/pgp.6.5.1.i and type:

If there are no errors, then continue to do an install by executing the following commands:

The directory $HOME/.pgp is the default directory where the keyrings and configuration file for PGP will be stored. This default can be changed by defining the PGPPATH environment variable. Otherwise, execute: