Topic 4
E-mail Security
[June 2018]
1. OpenPGP (Open Pretty Good Privacy) is a protocol for encrypting and signing messages and
creating certificates using public key cryptography. State the SEVEN (7) steps used to encrypt, sign
and decrypt a mail message. 7
The plaintext is compressed
A random session key is created
A digital signature is generated for the message using the sender’s private key and
then added to the message
The message and signature are encrypted using the session key and a symmetric
algorithm
The session key is encrypted using the recipient’s public key and added to the
encrypted message
The encrypted message is sent to the recipient
The recipient reverses these steps
2. Secure Multipurpose Internet Mail Extensions (S/MIME) supports encryption of email messages and
their contents via public-key encryption technology. State THREE (3) security services it provides. 3
Authentication (via digital signatures)
Message integrity (via digital signatures)
Non-repudiation of origin (via digital signatures)
Privacy (using encryption)
Data security (using encryption)
[March 2018]
3. State THREE (3) uses of cryptographic methods in email messaging. 3
To sign an email message to ensure its integrity.
To confirm the identity of its sender.
To encrypt the body of an email message to ensure its confidentiality.
To encrypt the communications between mail servers to protect the confidentiality of
both the message body and message header
4. Explain how the OpenPGP protocol is used to encrypt an email message. 7
1. The plaintext message is compressed
2. A random session key is created
3. A digital signature is generated for the message using the sender’s private key and
then added to the message
4. The message and signature are encrypted using the session key and a symmetric
algorithm
5. The session key is encrypted using the recipient’s public key and added to the
encrypted message
6. The encrypted message is sent to the recipient
7. The recipient reverses these steps
[December 2017]
1. Ransomware is one of the most prolific cybercrime problems. In 2017 we saw the impact of a global
ransomware attack, Wannacry. Explain the term Ransomware. 2
Ransomware is malware that prevents you from using your files or your computer,
and then extorts money from you in exchange for a promise to unlock them.
2. Explain how Wannacry was able to spread so far and fast. 1
WannaCry ransomware utilizes a Windows OS vulnerability
Topic - 4 Page 1
3. Wannacry encrypted files with a 128-bit AES key. The key is generated per file, is encrypted with
the generated RSA public key, and included in the encrypted file header.
What are AES and RSA? 2
AES : Advanced Encryption Standard – Symmetric Key Encryption
RSA : Rivest Shamir and Adleman – Asymmetric Key Encryption
4. If you were a Company Chief Information Security Officer, what actions would you take to improve
security from this type of cyberattack? You must justify your recommendations. 5
Initiating a training programme to establish a security culture in the company to
combat phishing
o This could be done by regular staff training
o This could be done by enforcement of policies
Review technical controls which include:
o Spam filters
o Frequent backups
o Only allowing minimum access to files to reduce possible impact.
o Patching o/s
o Anti-malware – kept up to date.
o Disabling hidden file extensions in Windows will also help recognize this type
of attack. (attachments often appear as [Link])
o Immediately isolating infected devices.
[September 2017]
5. OpenPGP (Open Pretty Good Privacy) is a protocol for encrypting and signing messages and
creating certificates using public key cryptography. State the SEVEN (7) steps used to encrypt, sign
and decrypt a mail message. 7
1. The plaintext is compressed
2. A random session key is created
3. A digital signature is generated for the message using the sender’s private key and
then added to the message
4. The message and signature are encrypted using the session key and a symmetric
algorithm
5. The session key is encrypted using the recipient’s public key and added to the
encrypted message
6. The encrypted message is sent to the recipient
7. The recipient reverses these steps
6. Secure Multipurpose Internet Mail Extensions (S/MIME) supports encryption of email messages and
their contents via public-key encryption technology. State THREE (3) security services it provides. 3
Authentication (via digital signatures)
Message integrity (via digital signatures)
Non-repudiation of origin (via digital signatures)
Privacy (using encryption)
Data security (using encryption)
[September 2016]
1. Anima and Ismail are discussing security of electronic communication. Anima says that she
vaguely remembers that when you are receiving important information over email, non-
repudiation is essential. However, she cannot remember what it means.
Briefly explain what is meant by the term non-repudiation. 1
Topic - 4 Page 2
Non-repudiation is the assurance that someone cannot deny something.
2. Ismail says that he thinks encryption or hashing are involved, but he cannot remember what the
difference is between the two terms. Briefly explain ONE (1) similarity and ONE (1) difference
between hashing and encryption. 2
A similarity is that both convert plaintext into a coded form that is not easily
understood.
A difference is that Hashing is on-way, while encryption is 2-way.
3. Anima uses a search engine to find out more information about non-repudiation and discovers
that it is achieved using a Digital Signature as follows:
i. The message is hashed (with agreed algorithm) to form a message digest (MD).
ii. The message digest is encrypted with the sender’s private key.
iii. The encrypted message digest is added to the message and sent.
iv. The recipient computes the message digest and also decrypts the encrypted message
digest with the sender’s public key.
v. The recipient compares the MD with the decrypted message digest.
a) Explain why the senders’ private key is used in step 2, rather than the senders’ public key. 2
The private key is only known to the sender and hence is the key information to
ensure the message comes from the sender
b) Explain why the senders’ public key is used in step 4, rather than the senders’ private key. 2
The Public key is the only one that can be used to decrypt a message encrypted by
the matching private key hence it enables the receiver to verify that the sender is
genuine.
c) Explain what comprises the Digital Signature and identify at which step above it is created. 2
The Encrypted MD, Step 2
d) If the comparison in step 5 fails, what do you conclude? 1
The message has been tampered with.
[June 2016]
1. David is worried about banking on the internet. He has read a report from Raytheon (2015)
which states that financial services companies encounter security incidents 300% more
frequently than other industries.
It also states that there is an increasing trend to target employees and trick them with phishing
emails and that cybercriminals bombard sites with low-level attacks (e.g. low-level DDOS) to
provide background noise which distracts security staff from targeted attacks
(Raytheon/Websense, 2015). David says he’s going to stop internet banking because of this
issue.
a) What is a phishing email? 2
A phishing email is one which poses as authorized emails from trustworthy
institutions.
It is an attempt to get recipients to surrender personal information such as bank
account details.
b) Do you agree with the report? 3
Topic - 4 Page 3
‘No’
These are attacks on employees, so if I stop internet banking this will not reduce my
risk.
(or)
‘Yes’
Phishing customers – I may get duped however careful I am, and install spyware
[June 2016]
1. When you are receiving important information over email, non-repudiation is essential. Briefly
explain what is meant by the term non-repudiation. 1
Non-repudiation is the assurance that someone cannot deny something.
2. Explain in detail how non-repudiation is achieved in email systems that employ OPenPGP. 7
It is achieved using a Digital Signature
A digital code (generated and authenticated by public key encryption) which is
attached to an electronically transmitted document to verify its contents and the
sender's identity.
The message is hashed with agreed algorithm) to form a message digest.
The message digest is encrypted with the sender’s private key.
The encrypted message digest is the signature which is added to the message and
sent.
The recipient computes the message digest and also decrypts the signature with the
sender’s public key.
The recipient compares the MD with the decrypted signature if they match the
message has not been tampered with.
3. Digital Certificates are important in this process. Explain the purpose of a Digital Certificate and
outline how you would obtain this certificate. 2
A Digital Certificate is a document that binds your public key to an identity that the
issuing Certification Authority (CA) is willing to vouch for.
Digital certificates can be self-generated, but these do not provide authentication.
Most commonly you will have to approach a Certificate Authority (CA)
[December 2015]
1. Important information is frequently sent over email. Three key requirements are Confidentiality,
Integrity and Authentication. Briefly explain what is meant by confidentiality, integrity and
authentication. 3
Confidentiality: The property that information is not made available or disclosed to
unauthorized individuals, entities or processes (ISO27000)
Integrity: The property of accuracy or completeness (ISO27000)
Authentication: is a process that ensures and confirms a user's identity.
2. Eve and Lucy are discussing the topic of email security. Eve recalls the term ‘digital signature’,
but cannot remember what it means. She comes to you for help. Briefly explain what is meant
by a Digital Signature and discuss how it can be created and used. 5
A digital code (generated and authenticated by public key encryption) which is
attached to an electronically transmitted document to verify its contents and the
sender's identity.
The message is hashed (with agreed algorithm) to form a message digest, and the
message digest is encrypted with the senders private key
Topic - 4 Page 4
The encrypted message digest is the signature which is added to the message and
sent.
The recipient computes the message digest (MD) and also decrypts the signature
with the sender’s public key.
The recipient compares the MD with the decrypted signature; if they match the
message has not been tampered with.
3. Which TWO (2) security attributes does a digital signature ensure? You should briefly explain
your answer. 2
Integrity (MD matches decrypted signature)
Authentication (Certificate + md could only be encrypted by the private key)
[December 2015 - Sample]
1. Explain what is meant by a digital signature and describe how it is generated. 6
A digital code (generated and authenticated by public key encryption) which is
attached to an electronically transmitted document to verify its contents and the
sender's identity.
The message is hashed with agreed algorithm) to form a message digest
The message digest is encrypted with the sender’s private key.
The encrypted message digest is the signature which is added to the message and
sent.
The recipient computes the message digest and also decrypts the signature with the
sender’s public key.
The recipient compares the MD with the decrypted signature. If they match, the
message has not been tampered with.
2. Does a digital signature ensure the entire message is encrypted? You should provide ONE (1)
reason to support your answer. 2
No – it ensures integrity, authenticity and non-repudiation.
3. Name the IETF standard for email security and briefly outline what additional security it
provides in addition to digital signatures. 2
S/MIME
Encryption of the body of the message using symmetric key method (3DES/AES)
Topic - 4 Page 5