Digital IDs and Encryption Mechanisms

Digital certificate contains
1. your digital id
2. set of your personal private and public encryption keys.

When you are part of an organization, the administrator can provide one for you
For personal use, obtain one yourself from
- Certificate Authority (organization that offers digital IDs)
- PGP Desktop Email uses PGP Global Directory at keyserver.pgp.com
Note: The bit length of your keys may vary depending on the algorithm for generating the key used by the certification authority:
- 40/64/128-bit RC2
- 56-bit DES
- 168-bit 3DES

Certification authorities keep track of certificates.
Digital IDs can be revoked due to:
- loss by the owner
- time expiration
- other reasons for termination.
To view the validity status of a digital ID while reading an digitally signed email, click the File menu, Properties, then Security tab.

Just like a file, a digital ID can get corrupted, lost, tempered with, etc.
Digital IDs are time-sensitive and may expire after a period of time.
To verify digital ID status, browser or email client can contact the certificate authority...
(a) via internet, or (b) certificate server may be present directly on the LAN...
(c) requesting information about the digital ID in question...
(d) Certification authority sends back digital ID status, whether it has been revoked, etc.
Security warning is generated by the browser or email client.
The warning contains problem details.
The user can decide whether to view the content or cancel.

Private keys that must be stored on your computer are only as secure as your computer.
Private keys installed on a computer are never
- transmitted with your email, or
- sent back to the certification authority for verification.
Once issued, the preservation of your private keys is your responsibility (including the backup.)

Your email client and server software must support S/MIME protocol,
Secure/Multipurpose Internet Mail Extensions.
Both sender and receiver should have copies of each other's digital IDs.
When you receive a digitally signed email message, email client automatically remembers sender's digital ID in your "Contacts" or "Address Book" folder.
Alternatively, digital IDs can be manually imported into the list of contacts.

Both parties should send each other digitally signed email messages.
Both parties should be able to encrypt/decrypt each other's messages without a problem.
All parties become participants in a secured email loop.

Click the Tools menu, then Options.
Click Security (or Secure Mail) tab, click Digital IDs (or Certificates.)
Click Import and follow the instructions...

Email sender can
- digitally sign the message
- encrypt the message to protect its content

Email recipient can
- verify who sent email
- verify that email was not altered in transition
- decrypt the message

EFS is a Feature of Windows that uses strong encryption for files and folders.
Designed for simple use:
1. Check box in the file or folder properties sets the encryption on/off.
2. The user controls who may have access to encrypted files.
3. File is decrypted when authorized user opens it.
4. File automatically is encrypted when closed by the user.
Unfortunately, EFS is not fully supported on Windows Vista Starter/Home Basic/Home Premium...
- ...so we need to seek an alternative solution, such as PGP Desktop Application from www.pgp.com

cipher.exe is a part of Windows Vista, but requires EFS to support encryption.
cipher.exe is a command-line tool that you can use to manage encrypted on Encrypting File System (EFS).
You can encrypt/decrypt files by running cipher.exe at the command prompt.
cipher.exe also provides basic means for key and certificate maintenance, such as certificate backup.

Go to www.pgp.com
Select PGP Trial Software Download in a ZIP file.
Download link is sent to you by email.
Download Trial version ZIP file.
Unzip and run the installer.
Enter your user name, email, etc.
- NOTE: You have to provide an address where you work or live; according to US government regulations and export control policies the locations where PGP products can be downloaded are restricted, since they are considered munitions quality.

Licensing: for free personal use select "use without license" option.
Every key pair that PGP generates must have
- user name associated with it
- valid email account
- secure passphrase to gain access to your keys