1. Signing and Encrypting Email With the Thawte Web of Trust CSU Professional Development Institute January 8, 2009 Steve Lovaas

2. Why are we here? We need to send sensitive information  Interception and eavesdropping are possible  Want to control who can read our messages We want to give assurance of what we send  Phishing and other fraud is common  Want to be more sure of who sent a message

3. What are the possibilities? Symmetric encryption  We both share a password or “shared secret”  Old tactic  OK as long as the key stays secret  But how to transfer the keys safely? Asymmetric encryption  A pair of keys that share a mathematical relation  Publish one (public), keep the other secure (private)  Public keys used in certificates

4. Symmetric Encryption

5. Asymmetric/Public Key Encryption …and signing is just the reverse process…

6. The Issue with Public Key Encryption Trust  Do you trust someone enough to store the public keys and keep them safe?  More important, how does the storing entity know it can trust that you are who you say you are? (Why should it grant you a key pair?)

7. Options for Public Key Encryption Pay a commercial PKI vendor ($$$) Run our own PKI (but who would trust us?) Use a Web of Trust  Distribute who can make identity assertions  Thawte is a company that does this  It’s free!  We have multiple Thawte notaries at CSU

8. The Thawte Web of Trust Sign up for an account with Thawte  Can get a free email cert that claims you are a “Thawte freemail member” Gain enough identity assertion points from registered Thawte notaries that Thawte feels it can trust who you are  Can get a free email cert that claims you are YOU (by name)

9. Will it work on… YES:  CSU central Exchange  College Exchange servers  CSU central UNIX servers with IMAP client (Windows, Mac, Linux)  College IMAP server NO:  Webmail  Exchange OWA  Google mail (yet)

10. The 5 Steps: 1-2 (here today) 1. Sign up for an account with Thawte 2. Visit at least two notaries for assertions We’ll get this far today. The rest is dependent on your particular OS and mail client, so is best done at your desk.

11. Steps 3-5 (back at your desk) 3. Request an email certificate from Thawte (You have a step-by-step handout of these directions) 4. Install the certificate on your computer (directions depend on your email client, help is available on the ACNS web site) 5. Distribute the public key to the people with you want to sign/encrypt messages (either publish to the Global Address List or send manually- help available on the ACNS web site)

12. Need Help? Call me at 297-3707 Email me at Steven.Lovaas@ColoState.EDUSteven.Lovaas@ColoState.EDU Come by my office at 601 South Howes We want this to work for you!