[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] Alice and Bob want to send secure emails.... oh and can they not be forwarded too? - THE OFFICIAL BLOG OF THE SBS "DIVA"
Tue, Jun 21 2005 23:30 bradley

Alice and Bob want to send secure emails.... oh and can they not be forwarded too?

A fellow MVP sent me an digitally signed email and asked if the email was encrypted.... but you see it wasn't.  Why not?  Because he didn't have 'my' digital certificate in his cert store.  You see when Alice want to send an encrypted email to Bob she must make sure that before she can encrypt the email between her and Bob that she has HIS digital certificate. It's not enough to have a Verisign email digital certificate, the person on the other end of the email transaction must have the certificiate as well.

So step number one for Alice is to purchase a digital certificate.  Step two is for Alice to send a digitally signed email to the person that you intend to encrypt email to [aka Bob].  Step three is to have Bob also buy a digital certificate and send a digitally signed email to Alice.  Once Alice and Bob have swapped these public keys, they can now send encrypted email to one another that can't be read in transit.  [it also won't show in your preview pane because it's encrypted]

Okay so now the email can't be forwarded on to anyone else right?  Uh...wrong.  To restrict forwarding, editing and what not, you'd need digital rights management [another server] to add to your network.  Even then, the last time I checked the license for the ability to do DRM outside the organization was pretty pricey.

....so...what do you think... yeah... like my fellow MVP said...not easy at all huh?

Encryption should be a lot more of a one button secure me now kind of process....and it's not.  Add to this the issue that I personally have with about 3 computers having my email, and you have to make sure my digital certificate is exported and moved to other computers.

Oh.... and encrypted instant messenger.... haven't thought of that one have you?  Those IM's you do are over the clear unless you encrypt it.  Here's one here for MSN if you'd like to try it out.

Filed under:

# re: Alice and Bob want to send secure emails.... oh and can they not be forwarded too?

Wednesday, June 22, 2005 6:19 AM by bradley

So in your first statement, your saying if I send what I think is an encrypted message out to a number of people, and i only have a digital cert on hand for half of them, one half will receive the message encrypted, and the other half won't? Also, you said he sent you a digitally signed message, and then asked you if it was encrypted, but that is two different things.

Even though it doesnt integrate as tightly, this is what made PGP such a nice alternative. I didnt need a thing from anyone else.

# Free Certificates for Encrypting E-mail

Wednesday, June 22, 2005 7:31 AM by TrackBack

# But you _do_ need their public key.

Wednesday, June 22, 2005 4:09 PM by bradley

It really doesn't matter what form of public key cryptography you're using, if Alice wants to encrypt a message for Bob, the only way to do it is for Alice to use Bob's public key to encrypt it.

Alice can't use her private key to encrypt it, because then anyone could decrypt it (because anyone can get Alice's public key).

Alice can't use her public key to encrypt it, because then only Alice would be able to decrypt it.

Alice can't use Bob's private key to encrypt it, because unless there's something intimate going on here, Alice shouldn't have access to Bob's private key.

Alice must use Bob's public key to encrypt the message.

The only remaining question is "how can Alice get Bob's public key?"

Bob sending Alice a signed email just happens to be the easiest way to get this done. Then Alice sends Bob an encrypted, signed message, and Bob can now encrypt messages for Alice. Note that after the first signed message goes out, everything remaining can be encrypted.

# re: Alice and Bob want to send secure emails.... oh and can they not be forwarded too?

Thursday, June 23, 2005 10:40 AM by bradley

And to make things more complicate, Bob could not just send Alice his public key (because Alice should not trust email headers ;-) - he should send it offline or Bob and Alice should trust the same Certification Authority and receive certificates

# re: Alice and Bob want to send secure emails.... oh and can they not be forwarded too?

Sunday, July 10, 2005 9:53 AM by bradley

I can speak to Tim's question.

If Alice wants to send an encrypted email to Bob, Susan, and James.

After you have created and addressed your message, select Send. If any of the recipients do not have digital signature certificates, then you will get an error message designating who does not have this. If you select Continue, it will send the email encrypted to all.

Those who do not have your Digital ID (and trusted you), will not be able to read your message.