--- title: "Email security with diagram and protocols" subject: "Internet and Intranet" chapter: 3 key: "semester_8/internet_and_intranet:email-security-diagram" source: https://www.bctengineer.com/q/semester_8/internet_and_intranet/email-security-diagram site: BCT Engineering --- # Email security with diagram and protocols Internet and Intranet · Chapter 3: Protocols and Client/Server Applications - Asked in: 2069 Bhadra (old course), 10 marks - Video: [Email security in network security](https://www.youtube.com/watch?v=WnRxl7rMloo) — EduFlair KTU CS - Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14 - Page: https://www.bctengineer.com/q/semester_8/internet_and_intranet/email-security-diagram - Whole chapter: https://www.bctengineer.com/md/semester_8/internet_and_intranet/chapter-3 ## Question Discuss an email security known to you. Explain your answer with necessary diagram and protocols. ## Short answer PGP provides end-to-end security via digital signatures and encryption. Sender hashes, signs with private key, encrypts with a random session key and receiver's public key. Radix-64 encoding makes it SMTP-compatible. ## Answer The e-mail security method discussed here is **PGP / S/MIME-style end-to-end protection**, backed by **transport security (SMTP over TLS, STARTTLS)**. Plain e-mail (SMTP, POP3) is sent as readable text, so it can be read, altered or forged on the way. #### Security services required - **Confidentiality**: only the receiver can read the message. - **Authentication**: the sender is who he claims to be. - **Integrity**: the message was not changed. - **Non-repudiation**: the sender cannot deny sending it. #### Pretty Good Privacy (PGP) PGP uses a hash, a public/private key pair and a one-time symmetric session key. **Sender** 1. Hash the message and encrypt the hash with the sender's **private key** (digital signature). 2. Compress the message + signature. 3. Encrypt it with a random **session key** (e.g. AES). 4. Encrypt the session key with the receiver's **public key**. 5. Convert to ASCII (Radix-64) and send via SMTP. **Receiver**: reverses the steps. He decrypts the session key with his private key, decrypts the message, decompresses it, and verifies the signature using the sender's public key. ```text SENDER RECEIVER Msg -> Hash -> Sign(KR_A) -+ v Msg || Sig -> ZIP -> Enc(KS) --> [SMTP/Internet] KS -> Enc(KU_B) ----------------^ | v Dec(KR_B)->KS -> Dec(KS) -> UNZIP -> Msg || Sig Verify Sig with KU_A -> Authentic + Intact ``` #### Protocols involved | Layer / protocol | Role | |---|---| | SMTP, POP3, IMAP | Carry the mail (PGP data is Radix-64 text, so it passes through) | | MIME | Formats attachments and non-text content | | S/MIME | Secure MIME with X.509 certificates, an alternative to PGP | | SMTP with STARTTLS (port 587) or implicit TLS (port 465), POP3S 995, IMAPS 993 | Encrypt the link between client and server and between servers | | SPF, DKIM, DMARC | Domain-level authentication against spoofing and spam | #### Key management - PGP uses a **web of trust**: users sign each other's public keys. - S/MIME uses a **certificate authority (CA)** hierarchy. #### Limitations TLS protects only individual hops, while PGP/S/MIME protect the message end to end (but headers such as sender and subject stay visible). ## Check yourself The answer's key points as multiple-choice questions, with the correct option and why. 1. Why is plain SMTP/POP3 e-mail insecure? A. It is sent as readable text so it can be read, altered or forged B. It uses UDP so messages are lost C. It cannot carry attachments D. It has no sender address Answer: A. Plain e-mail is unencrypted and unauthenticated, so it can be read, altered or forged in transit. (Key point: Why e-mail security is needed) 2. In PGP, how is the sender's digital signature produced? A. Encrypt the message with the receiver's public key B. Hash the message and encrypt the hash with the sender's private key C. Encrypt the session key with the sender's public key D. Compress the message with ZIP Answer: B. The hash is encrypted with the sender's private key; the receiver verifies it with the sender's public key, giving authentication and integrity. (Key point: Digital signature steps) 3. How does the trust model differ between PGP and S/MIME? A. PGP uses a CA hierarchy; S/MIME uses a web of trust B. Both use only symmetric keys C. PGP uses a web of trust where users sign each other's keys; S/MIME uses X.509 certificates from a CA D. Neither needs public keys Answer: C. PGP relies on a web of trust, while S/MIME uses a certificate authority hierarchy. (Key point: Key management) 4. What is the limitation of SMTP over TLS compared with PGP/S/MIME? A. TLS protects only individual hops, not the message end to end B. TLS cannot encrypt anything C. TLS only works for POP3 D. TLS provides non-repudiation Answer: A. TLS secures each link between client and server or server and server; PGP/S/MIME protect the message itself end to end. (Key point: TLS vs end-to-end) ## Related in Internet and Intranet - [Web-mail to POP3 message transfer protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finternet_and_intranet%3Aalice-bob-email-protocols) — Internet and Intranet, chapter 3 ## Related in other subjects - [Email server and its protocols](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Aemail-protocols-server) — Computer Networks and Security, chapter 6, asked 3× - [Security audit and security protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-audit-role-protocols) — Information System, chapter 2 - [Why two transport protocols exist](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Awhy-two-transport-protocols) — Computer Networks and Security, chapter 5 - [Switching and why necessary](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Aswitching-meaning-necessity) — Computer Networks and Security, chapter 2