Comparison Of Secure Email Technologies
X.509 / PKI, PGP, and IBE

Abstract

This work presents a list of desirable secure email features as well as a list of attacks or problems, with a corresponding score card for the secure email technologies X.509 / PKI, PGP and IBE. Concise definitions for each feature or problem regarding security and privacy of email communication are also included, with a view to both improve the email security technologies X.509 / PKI, PGP and IBE, and develop the specifications for new technology beyond current limitations. Usability, as an aggregation of properties, is considered the Most Important Feature of a secure email system. The IBE technology receives the highest Usability Score. However, the IBE technology receives the lowest Security Score. Both the Usability and the Security Scores may change according to a particular use environment.

Introduction

Email is just NOT a secure method of communication. Email has a number of longstanding security shortcomings that are being increasingly exploited in mass scale. There are several reasons for this state of affairs [1].

Email is used between individuals and also, in even larger volume, for organizational communication. The latter includes additional needs, such as sharing the responsibility between the organization and the person, formal work flow with structured documents, document release and retention policies, cross-organization end-points, and third-party verification services. In the 21^st century, email can no longer be that simple, text message that it was originally designed to be.

Notwithstanding its limitations, email communication is still very attractive because of its low cost and very large user base worldwide, with more than 500 million users:

Corporations, the largest market sector, have a clear need for email security. For very compelling business reasons including legal requirements, corporations need to send and receive private and secure messages between specific endpoints [2] -- and even be able to control them at the end-points.

There are many possible requirements for privacy and security for email, with varying degrees of assurances, cost, and benefits. For example, what works best within a large business enterprise may not be best suited for use with consumers or members of the public. Nonetheless, it is usually recognized that a secure email system should at least provide the Basic Features given below.

       Basic Features of Secure Email:

• message confidentiality (only the dialogue parties are privy to the message),
• message integrity (the message was not tampered with), and
  
• authentication (the dialogue parties have verified identities and / or credentials).
  

According to this classification, digitally signed email, for example, is not secure email. Even though it authenticates the sender and provides message integrity, it does not provide message confidentiality and does not authenticate the recipient. Encrypted email, when just message confidentiality is provided, is also not secure.

X.509 / PKI (Public-Key Infrastructure), PGP (Pretty Good Privacy) and IBE (Identity-Based Encryption) are three technologies that promise privacy and security for email. There are several products in the market, using these technologies, to secure email.

However, email encryption is not a mainstream application today -- not even for corporations. What's missing is the Most Important Feature of all: Usability -- including ease of use and ease of deployment.

Providing ease of use in email security is such a difficult task that it has not been done yet, even after 15 years of development (X.509 was released in 1988 and PGP in 1991). In a usability test done using PGP 5.0, when the test participants were given even 90 minutes in which to sign and encrypt a message, the majority of them were unable to do so successfully [WhTg1].

Still, even without usability considerations, providing email security is a difficult task. Email uses a store-and-forward messaging system from sender to recipient that is hard to control or even trace [4]. Secure Sockets Layer (SSL), an Internet security technology that can be applied well to secure credit card transactions, cannot secure email communications [5].

This paper compares the technologies X.509 / PKI, PGP, and IBE for secure email. This paper also provides a view to both improve these email security technologies and develop the specifications for new technology beyond current limitations.

This work begins with the specifications of Usability and Security. To create a metric for evaluating secure email systems that use different technologies, desirable features are listed in Section 1 while shortcomings (problems or attacks) are listed in Section 2. For clarity, these Sections also present concise definitions for each feature and problem or attack considered, in the context of secure email.

Based on these considerations, developed to be technologically neutral, Section 3 of this work uses the metric to present a score card for the secure email technologies X.509 / PKI, PGP, and IBE. In Conclusions, the score card is applied to rate the usability and security offered by the secure email technologies.

Usability

The Most Important Feature of a secure email system is Usability.

In practice, users will rather use an insecure email system that is easy to use than a secure email system where even the help text seems intimidating. The secure email system has to be be easy enough to use when compared with simple, familiar, regular email systems -- not when compared with other secure email systems. If security is too difficult or annoying, users may give up on it altogether.

Ease of use is considered here to be a self-evident need in all email security systems. See for example, the paper by Alma Whitten and J. D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0" [WhTg1].

In "Why Johnny Can't Encrypt" (op. cit.), the authors report a number of user interface design flaws, that may contribute to security failures, and a user test demonstrating that when the test participants were given even 90 minutes in which to sign and encrypt a message, the majority of them were unable to do so successfully.

While Whitten and Tygar make some good points, this paper takes the stance that what's needed for improved usability in secure email is, first of all, technology improvement.

Technology defines an upper bound for usability.

Usability may seem to be, inescapably, a user interface design problem (see, for example, [WhTg1]). However, when the role of user interface design is seen as that of providing a language for communication between the user and the system, it becomes clear that the language cannot be more expressive than the system's technology allows it to be -- even if the user has unlimited ingenuity and learning capacity. In short, if the technology does not allow it to exist, it cannot be expressed. Moreover, because communication cannot be 100% efficient, the system's technology provides an upper bound on usability -- user interface design, no matter how clever and sophisticated, can at best only reduce usability when compared with what the technology is potentially able to offer. Additionally, improving the graphical user interface and the help dialogue in email security products seems to have reached a point of diminishing returns after almost 15 years of development.

Therefore, rather than calling for more work on yet another improved graphical user interface and more help text to guide the user through all the steps required to send and receive secure email, with expected meager if not negative returns, what's needed is a real Reduction and Simplification of those steps at the technology level. What's need is technology with less complexity, less steps, less need for help text, and less need for the user to learn anything.

Usability is an aggregation of properties.

Usability (including ease of use and deployment) is generally unpredictable when looking into specific, isolated features. But usability is not entirely subjective, either. In practice, usability emerges from simple, effective rules that allow complex patterns to be expressed.

In summary: Usability is technologically supported and user interface design will, at best, reduce the usability inherent in the technology. To support usability, the technology should have simple, effective rules allowing complex patterns to be expressed as desired, rather than rules that require complexity from the start.

We note that because simplicity is also a basic principle for increased security, usability and security are not in conflict with each other -- contrary to common opinion, there should be no fundamental need to balance security with usability.

Usability is, thus, viewed here not as the result of any isolated property, or as a purely subjective evaluation, but as the result of an aggregation of properties. Usability can be technologically provided by inclusion of usability features as well as by exclusion of usability problems or attacks, with Reduction and Simplification of all rules.

Sections 1 and 2 present a majority of entries that are usability related. The most usability-relevant entries in Sections 1 and 2 are marked with rows in bold. Usability is provided as an aggregation of supported features and excluded problems or attacks, for each technology. The definition and evaluation of the Usability Score are presented in Section 3.

Security

An email message needs to be protected end-to-end, so that no one can eavesdrop, tamper, fake, spoof, or even automatically scan and index information from it while it moves from sender to recipient. In addition, an email may also need to be protected at the end-point -- with control features such as expiration ("self-destruct") and usage rights management.

The objective of a secure email system is, thus, more than just a secure transport, as done with a SSL secure web page. It is about control at the end-points, too. Without having to "do something" to sign or decrypt a message (i.e., operations that use private keys at each end-point), there's no control. One can have server control, client control and human control -- all are useful for secure email.

For example, for machine-to-machine secure communication one can have fully automatic email messages between two servers, signed and decrypted without anyone having to do anything -- and this is secure because the servers are in control.

Could we then have fully automatic, machine-to-machine secure email for human communication? No, because this is not a secure scenario for human correspondence. The servers / clients could fake a digital signature or decrypt a message without knowledge of the author or recipient. Humans need to be in sole control of their private-keys for secure human correspondence, even if the computational tasks are executed (as they must be) by a machine.

Control of private keys include control of digital signature and decryption keys. The need for signing keys to be in sole control of the signer is well-known, in terms of meeting legal evidence requirements, including use and revocation of the signing key (1.2). The same principle applies to decryption keys.

Decryption control is the dual of signature control, the latter provides assurance to the recipient that the message was sent only by the specified sender while the former provides assurance to the sender that the message can be read only by the specified recipient.

A secure email system needs, thus, to provide human control of signing and decryption. Human control of encryption and signature verification (i.e., operations that use public keys at each end-point) is usually not relevant for security and can be provided automatically to improve Usability.

Sections 1 and 2 present the desired security features and the undesired problems or attacks, for each technology. The definition and evaluation of the Security Score are presented in Section 3.

Auditing

The decision to trust a record (e.g., the source of a communication, or the name on a certificate) must be based on factors outside the assertion of trustworthiness that the record's system makes for itself. Accordingly, an auditing system should be as independent as possible from what is audited (the and should be provided together with a secure email system (for a secure system without auditing is not secure). The needs of the auditing system, standard in the art, are not mentioned in this paper. However, a secure email system should provide mechanisms for auditing. For example, features F17 ("Verified Timestamp") and F20 ("Visible Message Fingerprint") in Section 1 can be useful as auditing inputs that canbe verified independently of the email system.

1. DESIRABLE FEATURES REFERENCE SHEET

The table below focus on desirable features, where the entries in bold correspond to features that can considerably improve Usability by  Reduction and Simplification -- see also the bold entries in Section 2. The context of usage is likely to affect what features are most suitable. Desirable features are considered positive points in the metric.

2. PROBLEMS / ATTACKS REFERENCE SHEET

Problems and attacks are considered equally, in first-order approximation, as negative points in the metric. A justification for considering problems and attacks equally is that both reduce security. A secure email system that has problems will likely be used badly (insecurely) or not at all -- which opens room for attacks.

The entries in bold correspond to Usability problems. Absence of these problems can considerably improve Usability, by Reduction and Simplification. See also the bold entries in Section 1, for features that improve Usability. The context of usage is likely to affect what problems or attacks are most important.

3. COMPARISON CHART OF SECURE EMAIL TECHNOLOGIES (PRODUCTS)

This Section compares the technologies X.509 / PKI, PGP, and IBE, currently used with secure email products.

The methodology used, rather than comparing one secure email product with another, first establishes a technologically-neutral metric and then applies it to create a score card. The scores are based on market products that use each corresponding technology, measuring that technology's capability to support secure email.  Desirable features are taken as positive points (noted as +) while shortcomings (problems and attacks considered equally, in first-order approximation) are taken as negative points (noted as x) in the metric.

Thus, for each main market product using the technologies X.509 / PKI, PGP, and IBE, one asks two questions:

(1) what are the product's capabilities in terms of a list of desired features (the positive points), and

(2) what are the product's shortcomings in terms of a list of attack and problems (the negative points),

and assigns each score (positive or negative) to the technology used by that product. The lists presented in Sections 1 and 2 are used as the metric. At the end, scanning enough products, we have a list of all capabilities and all shortcomings that affect each technology, as a score card.

Usability: The entries in bold correspond to potential improvements in Usability by Reduction and Simplification, with inclusion for features and exclusion for problems / attacks. Usability is an aggregation of those properties.

Usability and Security Scores: Using the score card below, they are defined as: - Usability Score is the total number of bold rows with (+), minus the total number of bold rows with (x); - Security Score is the total number of rows with (+), minus the total number of rows with (+).

Conclusions

A series of conceptual, legal and implementation features and problems / attacks have been discussed and presented together with a score card for the email security technologies X.509 / PKI, PGP and IBE, with their pros and cons regarding security and privacy of email communication. Usability, as an aggregation of properties, is considered the Most Important Feature of a secure email system. This work also provides a view on what to improve regarding the email security technologies X.509 / PKI, PGP and IBE, in order to develop the specifications for new technology beyond current limitations.

Using the score card given in Section (3), the Usability Score and the Security Score were defined and calculated for each technology. Both the Usability and the Security Scores may change according to the particular use environment.

The IBE technology receives the highest Usability score. However, the IBE technology receives the lowest Security socre.

Notwithstanding this result, the paper finds that because simplicity is a basic principle for both Usability and Security, usability and security are not in conflict with each other -- contrary to common opinion, there should be no fundamental need to balance security with usability.

Because any feature or problem / attack can be considered to be optional, readers can pick and choose what they want for each technology, to make their own subset of the score card, valid for their needs, budget, usage and other factors. One can also rate individual products, including products using different technologies, by comparing their score cards. For product evaluation, the check mark can be changed to a product-specific grade.

The author acknowledges important contributions in private and public comments from readers. The public comments are available, for the most part, in the email-security.net Blog and also in messages in other Blogs and listservers.

REFERENCES

[Ge1] See E. Gerck, "Trust as Qualified Reliance on Information, Part I", The COOK Report on Internet, Volume X, No. 10, January 2002, ISSN 1071 - 6327, in http://nma.com/papers/it-trust-part1.pdf.

[WhTg1] Alma Whitten and J. D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0", in http://www.gaudior.net/alma/johnny.pdf

[1] Email communication is much like anonymous postcards, answered by anonymous recipients. Anyone can send an email in your name or using your email address. Every email or attachment you send over a computer network is copied (and perhaps even backed up) on many different computers, without your explicit knowledge or consent. However, email messages, open for anyone to read -- and even write in them -- are expected to carry secure and private messages between specific endpoints. The Internet, as an open network with open participation, has also increased the need for email security far beyond the threat model considerations envisioned when email was first specified, more than a generation ago, for a closed Internet with vetted participants (ARPANET). Today, the Internet has more than one billion users [Morgan Stanley Research, 2005]. A second billion ussers is expected to follow in the next ten years, bringing a dramatic change in worldwide security and usability needs.

[2] While email privacy and security encompass many possible needs, in general any email that can be read or used without authorization present a liability. For example, a corporation's reasoning behind a contract negotiation might be harmful if revealed even after the contract is signed. In practice, however, users are neither careful enough in selecting email content to prevent any harmful disclosure when they send email nor assiduous in protecting all email messages they receive. In the event that regular email has to be used in a business or legal communication, content should be limited considering that disclosure to third-parties cannot be avoided and confidentiality disclaimers should be used to state that fact. The Missouri Bar Disciplinary Counsel, for example, requires all Missouri attorneys to notify all recipients of e-mail that:

(1) e-mail communication is not a secure method of communication; (2) any e-mail that is sent between you and this law firm may be copied and held by various computers it passes through as it is transmitted; (3) persons not participating in our communication may intercept our communications by improperly accessing your computer or this law firm's computers -- or even some computer unconnected to either of us that the e-mail may have passed through.

[3]

[4] Email is not a point-to-point message between one client and one server (as a web browser viewing a web page at a server). Email is a store-and-forward message from one client to another client, with possibly several independent servers, routers, caches, buffers, content analyzers, human agents, traffic analyzers, monitors and storage devices in-between the two clients, all acting at different times and with possibly long delays. Store-and-forward supports availability, reliability and anonymity for email.  Anonymity or pseudonymity, for example, cannot be achieved if there is a direct connection from the sender to the recipient because it can be traced. For strong anonymity or pseudonymity, email messages can use anonymizing remailers with random latency store and forward.

[5] SSL provides for encryption between two communicating points, such as a client application at a desktop PC and an application at a secure Internet server, usually authenticated at the server end only. Data can be transmitted using SSL over the Internet in point-to-point, two-way secure communication, encrypted at the sending point and decrypted at the receiving point. However, SSL, by itself, cannot protect an email message from client to client [4], and thus cannot prevent spam, spoofing, phishing and pharming either -- all of which affect email security.

[6] Ross Anderson, University of Cambridge Computer Laboratory, UK.

[7] For X.509 / PKI the delay betwen a certificate being revoked and the actual posting of the revocation can be quite small, through the use of OCSP or other real-time discovery technologies. However, the delay between the CA receiving from the subscriber a notice to revoke and the actual posting of the revocation can be quite large and even, usually, unspecified by the CA (e.g., to reduce liability). See Ed Gerck, "Certificate Revocation Revisited, Internet X.509 Public Key Infrastructure". IETF PKIX Working Group, draft-gerck-pkix-revocation-00.txt, in http://www.faqs.org/ftp/pub/internet-drafts/draft-gerck-pkix-revocation-00.txt

[8] Key escrow is a backdoor to decrypt a message without the author's or recipient's cooperation or knowledge; if signing keys are  included, anyone's digital signature can be forged. Businesses, to avoid the key escrow backdoor liability and yet prevent problems if the proverbial bus hits an employee, may use message escrow (e.g., a secure email copy that can be decrypted by selected persons in administration) for sensitive communications. For policy or law enforcement purposes, communication information (such as routing, IP numbers, email addresses, file size, time, and frequency of use) can also be used.

DISCLAIMER

This paper does not intend to cover all the details of the technologies reported, or all the variants thereof. Its coverage is limited to provide support and references to the work in progress on new email security technology and to unify references, concepts and terminology. No political or country-oriented criticism is to be construed from this work, which respects all the apparently divergent efforts found today on the subjects treated. Products, individuals or organizations are cited as part of the fact-finding work needed for this paper and their citation constitutes neither a favorable nor an unfavorable recommendation or endorsement.

Copyright © 2005 by E. Gerck, first published online on December 6, 2005.
All rights reserved, free copying and citation allowed with source and author reference.