©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 1 IPSI 2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Dr. Nick Cercone Faculty of Computer Science Dalhousie University

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 2 IPSI 2003 OverviewOverview Introduction Current security Secure Mail Transfer Protocol DiscussionConclusion Future work

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 3 IPSI 2003 IntroductionIntroduction is everyday used in electronic world Simple Mail Transfer Protocol (SMTP) is trivial and anonymous Security is need for transferring over internet

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 4 IPSI 2003 SMTPSMTP

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 5 IPSI 2003 Current security Confidentiality and Integrity AuthenticationNon-repudiation User Applications Web Applications

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 6 IPSI 2003 Secure Mail Transfer Protocol (SecMTP) Overview Assumption and Limitation ArchitectureSpecificationExample

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 7 IPSI 2003 SecMTP: Overview Incorporate security procedure into SMTP Maintain the simplicity and compatibility that SMTP provides Achieve the five security goals: confidentiality, integrity, authentication, non- repudiation, and certification

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 8 IPSI 2003 Assumption and Limitation All SecMTP compliant servers must be properly certified Non-repudiation has to be implemented SecMTP user trusts the integrity of the end servers but not the intermediate connection We designed SecMTP’s architecture, protocol specifications, and SecMTP Extension Service to SMTP

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 9 IPSI 2003 The SecMTP Architecture SecMTP architecture with the extension of security services

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 10 IPSI 2003 The SecMTP Specification Default specification User requested options

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 11 IPSI 2003 The SecMTP Default Specification TLS channels Authentication headers Digital signature TTP (if receiver non-repudiation is required)

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 12 IPSI 2003 The SecMTP User Requested Options Receiver public key encryption Sender private key digital signature Restrict option Seamless interfaces Users private/public keys are stored at the server machine

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 13 IPSI 2003 The Timing Diagram of SecMTP (1)

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 14 IPSI 2003 The Timing Diagram of SecMTP (2)

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 15 IPSI 2003 The State Diagram of Starting a SecMTP Connection

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 16 IPSI 2003 SMTP Extension Service for Secure Mail Transfer Protocol (SecMTP) 1.The name of the SMTP service extension is “Secure Mail Transfer Protocol” 2.The EHLO keyword value associated with the extension is SECMTP 3.No parameters are allowed with this EHLO keyword value

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 17 IPSI 2003 SMTP Extension Service for Secure Mail Transfer Protocol (SecMTP) 4.Three option parameters are added to the RCPT command: SIGN: digitally sign message header consisting of a message digest and sender identity ENCR: encrypt the message with receiver public key STRICT: only transfer the message through properly authenticated and certified SecMTP servers 5.No additional SMTP verbs are defined by this extension

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 18 IPSI 2003 ExampleExample S: S: C: C: S: 220 foo.com SMTP service ready C: EHLO bar.com... C: STARTTLS C \& S: C \& S: C: EHLO S: AUTH CRAM-MD5 DIGEST-MD5... C: AUTH CRAM-MD5 S:

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 19 IPSI 2003 Example (cont.) C & S: C & S: S: 235 authentication successful C: EHLO S: SECMTP... C: SECMTP S: 220 welcome SecMTP service ready C: MAIL FROM: C: MAIL FROM: S: 250 OK C: RCPT TO: C: RCPT TO: S: 250 OK C: RCPT SIGN S: 250 OK Digital Signature for

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 20 IPSI 2003 Example (cont.) C: DATA S: 354 Start mail input; end with. S: 354 Start mail input; end with. C: Data data data... C:...etc. etc. etc. C:. S: 250 OK C: QUIT S: 221 foo.com Service closing transmission channel

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 21 IPSI 2003 Discussion (1) Advantages Seamlessly integrate with existing systems Compatible with SMTP and current service extension Does not require specific action from the users Provide user-to-user level of security Provide both best-effort and guaranteed security services

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 22 IPSI 2003 Discussion (2) Shortcomings Non-SecMTP clients need to examine the security information manually Encryption and decryption are done at the server Users must trust the end servers to provide security services The SecMTP servers may become bottleneck SecMTP compliant clients and servers are required to achieve full benefit of SecMTP

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 23 IPSI 2003 ConclusionConclusion Secure communication -> TLS channels Authentication and certification at servers -> AUTH and header Confidentiality users -> Public key encryption Authentication and integrity at users -> Digital signatures Sender non-repudiation -> Digital signatures Both sender and receiver Non-repudiation -> TTP Guarantee security service -> STRICT option

©2003 Hathai Tanta-ngai, Tony Abou-Assaleh, Sittichai Jiampojamarn, and Nick Cercone 24 IPSI 2003 Thank you !!! or