Electronic Mail Security Notes

Chapter 3: Electronic Mail Security

Internet Mail Architecture
  • RFC 5598: Defines the components and structure of Internet mail architecture.
  • Protocols: HTTP (Hypertext Transfer Protocol) and SMTP (Simple Mail Transfer Protocol).
Key Components:
  • User Agent: The email client that users interact with.
  • Mail Server: Manages and routes email messages via SMTP.
Example Structure:
  • Alice's User Agent → Alice's Mail Server → Bob's Mail Server → Bob's User Agent.
Key Email Components
  • Administrative Management Domain (ADMD): This is the Internet email provider managing the Message Transfer Agent (MTA).
  • Domain Name System (DNS): Facilitates the mapping of hostnames to IP addresses for email delivery (e.g., resolving the address in student@uniten.edu.my).
Email Protocols
  • SMTP (Simple Mail Transfer Protocol):
    • Initial version released in 1982 as RFC 821.
    • Designed primarily for transferring text emails, revised to RFC 5321.
    • ESMTP (Extended SMTP): Defined in RFC 1869, adds support for attachments and multiple recipients.
  • Mail Access Protocols:
    • POP3 (Post Office Protocol version 3): Uses TCP port 110; allows downloading of emails.
    • IMAP (Internet Mail Access Protocol): More complex than POP3, uses TCP port 143, allows manipulation of emails on the server.
MIME (Multipurpose Internet Mail Extension)
  • Purpose: Extends SMTP to include non-ASCII content (e.g., images, attachments).
  • Header Fields: Carries information on message body formats.
  • Transfer Encodings:
    • 7bit: ASCII only.
    • 8bit: May include non-ASCII.
    • binary: For arbitrary binary data.
    • quoted-printable: Mostly ASCII but allows some non-ASCII characters.
    • base64: Encodes data and represents them as printable ASCII characters.
Email Threats and Mitigations
  • Authenticity Threats: Unauthorized access or impersonation.
  • Integrity Threats: Unauthorized modifications of email content.
  • Confidentiality Threats: Unauthorised disclosure of sensitive information.
  • Availability Threats: Disruption of email service.
STARTTLS and SSL/TLS
  • STARTTLS: Command issued by email clients to upgrade to a secure connection.
    • Ports:
    • SMTP: 25 (Plaintext), 587 (Explicit TLS), 465 (Implicit TLS)
    • IMAP: 143
    • POP3: 110
  • Modes:
    • Explicit SSL/TLS: Starts as insecure and upgrades.
    • Implicit SSL/TLS: Starts securely.
S/MIME (Secure/Multipurpose Internet Mail Extension)
  • Overview: Enhances MIME with security features.
  • Key RFC Specifications:
    • RFC 5750: Certificate Handling
    • RFC 5751: Message Specification
    • RFC 2634: Enhanced Security Services
    • RFC 5652: Cryptographic Message Syntax
  • Typical Services:
    • Digital Signature: RSA/SHA-256
    • Message Encryption: AES-128
    • Compression: Reduces size for storage/transmission.
    • Radix-64 Conversion: Converts messages to ASCII strings.
Pretty Good Privacy (PGP)
  • Overview: Alternative email security protocol similar to S/MIME, developed by Phil Zimmerman and first released in 1991.
Domain Name System (DNS)
  • Function: Maps hostnames to IP addresses used for locating email servers.
DNS Security Issues
  • DNS without security: Vulnerable to various attacks (e.g., DNS spoofing, denial of service).
Other DNS Security Protocols
  • DNS over TLS (DoT): Encrypts DNS queries over TCP on port 853.
  • DNS over HTTPS (DoH): Utilizes HTTPS for DNS queries on port 443.
  • DNSCrypt: Encrypts DNS traffic without using TLS.