In this article I'll provide some basic guidelines for implementing X.509 PKI-based e-mail encryption that you can implement for free! The goal for this article is a process you can use with your business associates and/or friends to exchange e-mail securely, with no additional software to install, and no costs to anyone in the process. Sounds too good to be true? Not at all!
Usually we send e-mail over public networks--via ISPs that guarantee no level of confidentiality. We've probably all received passwords or other sensitive information via Internet e-mail at some time in the past. Have you ever thought to yourself, "wouldn't it be great if I could easily send this e-mail in a way that only the recipient could read it?"
Probably the most popular mechanism for sending encrypted is the proprietary--and until recently free--PGP client software. I've long been a fan of PGP, which is not just good for e-mail privacy, but also for transmitting data securely. But for e-mail encryption, PGP is traditionally a little nerdy to use, and I can't say I've ever had a business contact ask me to send him or her a PGP key. The newer commercial versions of PGP clean up the clunkiness quite a bit, but installing PGP client software is a big step, may be prohibited by company policy, and even though $99/user isn't going to break the bank, a free alternative would be easier, right?
X.509 Public Key Infrastructure (PKI) based encryption has been available for years, but in my experience is rarely implemented. Perhaps the primary reason is complexity, low perceived need-level and/or inconvenience.
Recently I took a look at using X.509 PKI keys in conjunction with Outlook 2007, and I was amazed at how simple it was to implement--at least at an informal peer-to-peer level. Although I'm using Outlook 2007, the ability to use certificates to send/receive encrypted e-mail isn't new with the 2007 version, and this basic approach will work with virtually any Microsoft e-mail client, and in fact most other e-mail clients as well.
Let's look at how to implement this solution. Setting up X.509 within Outlook 2007 has a few requirements:
-
-
Each party must have the private key installed on their own Windows PC
-
Each party must have the public key for the other party in his/her local certificate store
Once everything is setup, the process is really pretty simple:
-
The sender uses the recipient's public key to encrypt the e-mail message as it's sent
-
The receiver uses his/her own private key to decrypt the message
We'll return to getting "everything setup" in a minute, but first a little bit more about why this process works...
PKI e-mail certificates work because anyone can encrypt a message using the recipient's public key, but only the recipient's private key can reverse the process--yielding a decrypted message. So the public key can be distributed to anybody without compromising the solution. Only the accidental release of the private key will compromise the security of the transaction. If this sounds like SSL (the technology used to encrypt your credit card on amazon.com), that's because it's almost exactly the same.
So, you ask, does that mean I have to buy an SSL certificate for my e-mail program--just like I do for my web servers--and all my e-mail recipients have to do the same? Well, yes--and no. Just as with SSL certificates, anyone can issue them. You could create your own certificate, and your associates could create their own as well. The problem is that if you issue your own certificate (i.e. you become your own CA), you need to convince everyone you send e-mail to to trust your self-signed certificates. Actually it's not your friends you need to convince--it's their computers.
So, for self-signed certificates to work seamlessly, you'd have to get all your recipients to install your root certificate into their computer. This is a reasonable thing to do if all users sending/receiving e-mail are within your company, but when it comes to external recipients, self-signed certificates may well be impractical. Just as with web site SSL certificates, it's easier to use a commercial CA that everyone else already trusts.
So, to exchange e-mail securely with external associates, the best option is to use certificates issued by a commercial, trusted CA. These certificates are fairly inexpensive, and can even be obtained for free from Thawte and Comodo. There are some good reasons to buy blocks of certificates from these companies and roll them out in your company. However, for our informal solution, we'll just use free certificates from Comodo.
OK, enough background. Let's get this implemented. Here's the process:
-
Go to Comodo's web site, and obtain a free secure e-mail certificate. Just follow the instructions (which I won't go through completely here). At the end of the process, the certificate will be installed in the certificate store on your Windows PC.
-
Have the intended recipient(s) of your encrypted e-mail also obtain secure e-mail certificates. It doesn't matter whether everyone uses the same provider (Thawte, Comodo, Verisign, etc.).
-
Send each of your intended recipient(s) a signed e-mail. This is easy to do--just click the "Digitally Sign" button in the Outlook 2007 Options ribbon bar section. Your recipient(s) should also send you a signed e-mail button.
-
Sending the signed e-mail messages is just a way to exchange public keys (remember, you need to have the recipient's public key to encrypt a message before sending it to him/her).
-
When you receive a Digitally Signed e-mail, right click on the 'From:' e-mail address, and add the contact to Outlook. If your recipient's contact information is already in Outlook, accept Outlook's warning and let it update contact information. This will add the public key to the existing contact record. Your recipient should do the same with your signed e-mail so he/she can encrypt e-mails for you.
Now that you have your recipient's public key, and your associate(s) have yours, all you have to do is click on the "Encrypt" button in the Outlook 2007 Options ribbon bar section before you send the e-mail.
That's it! Now you and your associates can send encrypted e-mail to each other anytime you want. In fact, it's so seamless you probably won't even be aware that the e-mail you receive is encrypted--Outlook will automatically decrypt e-mail for you as you read it. If you want to verify that the process is actually working (and of course you do!), there are two simple ways to know a received e-mail is encrypted:
First, the e-mail reading window will have one or two icons: the first looks like a padlock, and indicates the message is encrypted. The second looks like a 4-H ribbon, and indicates the message is signed. These are the same icons used in the Outlook tool-bar.
The second clue that a message is encrypted is that Outlook can't display it in the preview pane:
Now that your certificate is installed, whenever you have a request to send or receive encrypted e-mail with an external associate, simply exchange public keys (by sending digitally signed messages to each other), and you're on your way!