Mirror Magazine

Mirror Magazine

Techno Page - By Harendra Alwis

Want to find out how things are done? Got questions to ask?

Email security
By Hans W Thomasz
Millions of e-mails are transferred via the Internet. Sometimes highly confidential information is sent and you might receive an e-mail from a party unknown to you. How could you know whether this e-mail contains a virus?

To ensure e-mail security you need to encrypt it; to encrypt e-mails you need to have something called a digital certificate.

What is encryption?

It is a method of scrambling the message you sent so that even if a third party intercepts the message, it would give no meaning. We will look into some of the encryption methods later on. As mentioned to encrypt a message you need to have a digital certificate.

What is a digital Certificate?

In simple terms a digital certificate is similar to your NIC No., passport No. or driving licence No.

Like NICs there are certification authorities that issue digital IDs. They are available online. Microsoft has a list of certification authorities. Some of them charge a fee and some of them are free of charge. A certification authority verifies your identity, hence any one receiving an e-mail with your digital signature, could be sure that it is from you.

To digitally sign e-mails it is important to know that the receiver should have their own digital certification as well. Microsoft Outlook will automatically check for the senders' digital signature and store it on your computer. It will then operate when you send or receive e-mails.

To send a digitally signed e-mail simply type the e-mail and click on the "sign" button on the tool bar and send. When you do so a 'rosette type' symbol would appear (to the right of the message), signifying that your message carries your digital signature.

Getting a digital signature can be a lengthy task. However it is much easier than applying for your driving licence or passport. The process is such that you have to provide a lot of information about yourself and prove that you are who you claim to be to the certification authority since they in turn are going to validate your identity to others. Having a digital signature is very effective when it comes to e-mail security. Once they (the certification authority) are satisfied with the information you provided they will provide you a download of your digital signature and along with that you receive something called a 'private key' and a 'public key'.

Now that you know what a digital signature is let us look into the main factor of e-mail security which is encryption.

Digital certificates are more than a form of identification, its existence enables a user to encrypt (encode) messages, which means it is secure on its journey through the Internet, protecting it from an intruder reading the true contents of the message.

Encryption and digital signature can be used together or separately.

* A message can be encrypted, but not digitally signed (only a person with the decryption key could read it, but they cannot be sure of the person who sent it)

* A message can be digitally signed, but not encrypted (everyone can tell who wrote it and anyone can read it)

* A message can be encrypted first and then digitally signed (only some one with the key can read it, but anyone could tell who wrote it)

* A message can be digitally signed first and then encrypted (only someone with the key could read it and only the same person could tell who wrote it). This is the recommended combination for confidential e-mails.

From a user's point of view you only need to have the digital signature. Thereafter when you want to send an e-mail and intend to add security to it, all you have to do is type the e-mail and simply click on the "sign" and "encrypt" buttons that appear on your screen or in a menu of your e-mail client. The rest of the operation (encrypting messages sent by you and decrypting encrypted messages received by you) takes place backstage.

How encryption works
Although you don't need to know how encryption works to encrypt a message let us step a bit further and see how encryption really works.

Encryption is modifying or scrambling a message. Suppose we take a message and change each letter by substituting each letter to the next letter in the alphabet. So if the key is 1 it means shift by one letter, if the key is 2 then shift by 2 letters. To elaborate;

If the key is 1 = A becomes B, B becomes C and so on.
If the key is 2 = A becomes C, B becomes D and so on.

Therefore if the message is "I won a lottery" the encrypted values of the message would read as;

If the key is 1 = J XPM B MPUUFSZ
If the key is 2 = K YQP C NQVVGTA

To decrypt the message the recipient should use the key in reverse order. It's quite obvious that this type of encryption is too simple to be used in real life, since the key could be easy to find just by trying 25 possible numbers (referred to as key space).

In real life scrambling mechanisms are much more complex and the key space (possible tries) is much larger. The science of encrypting messages using complex formulas and methods are called cryptosystems.

How to send a secure e-mail

1. Obtain digital signature (only for the first time)
2. Type your e-mail
3. Click on the "sign" button
4. Click on the "encrypt" button
5. Click the "send" button
Now relax. Your message is safe and secure!

Digital divide
This is a term that is often used to describe the divergence between people who have access to and the resources to use new information and communication tools, such as the Internet, and people who do not have the resources and access to the technology. It also describes the difference between those who have the skills, knowledge and abilities to use the technologies and those who do not. The Digital Divide can exist between those living in rural areas and those living in urban areas, between the educated and uneducated, between economic classes, and on a global scale between more and less industrially developed nations.

Back to Mirror Magazine