E-mail Security: Threats, PGP, and S/MIME

Why Do We Need E-mail Security?

Electronic Mail (E-mail) is the backbone of corporate, academic, and banking communication. Every day, over 300 billion emails are sent worldwide using protocols like SMTP (Simple Mail Transfer Protocol), POP3, and IMAP.

However, standard SMTP was designed in 1982 without built-in encryption or sender verification. By default, a traditional email is like a paper postcard:

1. Anyone who handles the postcard along the route can read the message (No Confidentiality).
2. Anyone can write a fake “From:” address on the postcard to pretend to be someone else (Email Spoofing — No Authentication).
3. Anyone can alter the words on the postcard in transit (No Integrity).

E-mail Security is the set of cryptographic protocols and policies that transform an insecure “postcard” email into a sealed, tamper-proof, digitally signed envelope.

1. Common E-mail Security Threats

Before learning the solutions, you should write these 5 common email threats in your exam:

1. Email Spoofing: Forging the "From:" header so an email appears to come from a trusted source (like [email protected] or your college principal).
2. Phishing & Spear-Phishing: Sending urgent, deceptive emails with fake login links to steal passwords, credit cards, or OTPs.
3. Malicious Attachments (Malware/Ransomware): Hiding viruses, Trojans, or ransomware inside .exe, .zip, or macro-enabled .docx / .pdf email attachments.
4. Eavesdropping (Email Interception): Reading confidential corporate or personal emails as they pass through mail servers.
5. Spam & Mail Bombing: Flooding a user’s inbox with thousands of junk emails so they miss genuine messages or the mail server crashes.

2. Two Major E-mail Security Protocols: PGP and S/MIME

To secure emails end-to-end, two industry-standard cryptographic protocols are used:

1. PGP (Pretty Good Privacy)
2. S/MIME (Secure / Multipurpose Internet Mail Extensions)

3. PGP (Pretty Good Privacy)

Invented by Phil Zimmermann in 1991, PGP (Pretty Good Privacy) is the most famous open standard (OpenPGP) for encrypting and digitally signing emails and files.

The 5 Core Services Provided by PGP:

1. Authentication (Digital Signature)

• How do you know the email really came from the sender?
• PGP creates a Hash of the email using SHA and encrypts that hash using the Sender’s Private Key (via RSA or DSS) to attach a Digital Signature.
• The receiver verifies it using the Sender’s Public Key.

2. Confidentiality (Message Encryption)

• How does PGP hide the email content?
• Since RSA is too slow for long emails with big attachments, PGP generates a random 128-bit Symmetric Session Key and encrypts the email fast using AES, 3DES, or IDEA.
• Then, PGP encrypts that small Session Key using the Receiver’s Public Key (RSA) and attaches it to the email!

3. Compression (ZIP)

• PGP compresses the plain text message (and signature) using the ZIP algorithm before encrypting it.
• Why compress before encryption? Because encrypted Cipher Text looks completely random and has no repeating patterns, so compressed plain text shrinks nicely and also makes cryptanalysis harder!

4. E-mail Compatibility (Radix-64 / Base64 Encoding)

• Many older email servers (SMTP) only understand 7-bit ASCII text characters and corrupt raw 8-bit binary encrypted data.
• PGP uses Radix-64 (Base64) conversion to turn every 3 bytes (24 bits) of encrypted binary data into 4 printable ASCII text characters so it can travel safely through any email server!

5. Segmentation and Reassembly

• If an email is very large (e.g., over 50 KB), PGP automatically splits it into smaller emails and reassembles them at the receiver’s end.

4. S/MIME (Secure / Multipurpose Internet Mail Extensions)

What is S/MIME?

• Standard MIME is an extension to SMTP that allows emails to carry non-text attachments like images, audio, video, PDFs, and HTML.
• S/MIME (Secure/MIME) adds cryptographic security (Digital Signatures and Encryption) to MIME emails!
• Unlike PGP (which uses a decentralized “Web of Trust” where users verify each other’s keys), S/MIME uses official hierarchical X.509 Digital Certificates issued by Certificate Authorities (CAs), making it the top choice for large corporations, banks, and enterprise software like Microsoft Outlook and Apple Mail.

5. Comparison: PGP vs. S/MIME

💡 DAVV Exam Preparation Tips

10-Mark Question: “Why is E-mail security needed? Explain how PGP (Pretty Good Privacy) and S/MIME provide email security.”

• Explain why plain SMTP is like an open postcard (vulnerable to spoofing, phishing, and eavesdropping).
• Draw the PGP 4-stage pipeline diagram: Authentication (Signature) → Compression (ZIP) → Confidentiality (Session Key + RSA) → Radix-64 conversion.
• Add the PGP vs. S/MIME comparison table to score full marks.