Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If the subject makes no sense to you, that's fine, it makes no sense to me.

I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to clarify some requirements. Apparently the source and destination ip addresses need to be encrypted, along with the username used to log in, and the email message itself.

In order to encrypt the source and destination IP addresses of a conversation, it looks like I'd need to use something like IPSec, correct? And that would be done at the OS level, not just as part of an application when sending an email, correct?

For encrypting the username, I have no clue what that means. Seems like if I encrypt the credentials when attempting to log in, I won't be able to log in unless the server can decrypt them somehow.

For encrypting the email itself, if I use something like PGP, I would need to set up keys on the device sending the email, and the receiver's machine, correct?

I've done some research on the requirements, and the above is what I've come up with. Looking for some intelligent questions to ask, and validation of my assumptions above.

thanks,
Mark

share|improve this question
1  
What is the use case? Can you just tunnel email traffic through vpn? –  Robert Feb 22 '12 at 19:37
    
The use case is when some event happens (smoke alarm/temperature our of range...), an email gets sent. This is typically from an embedded device which is also doing a lot of communication with other devices on the network. –  MStodd Feb 22 '12 at 22:17
    
Surely if you encrypt the destination IP address it will not be able to get where its going? –  Toby Allen Feb 22 '12 at 22:37
    
@TobyAllen and if I encrypt the source address, I won't be able to get a response... That's why I was considering looking into IPSec (if I understand it correctly) –  MStodd Feb 22 '12 at 22:53
1  
Encryption is a mechanism (a means to an end, not the end in itself). To ask intelligent questions, you could start by asking: What are you trying to achieve? What threats are you trying to protect against? What would be an example of a "bad thing" you don't want to happen? Once we understand what the goals are, then we can recommend technical mechanisms to achieve those goals. –  D.W. Feb 23 '12 at 8:35
add comment

2 Answers

up vote 6 down vote accepted

To protect packet destinations, you need to abstract the network layer entirely - which usually means some form of encrypted VPN. This would mean no hardware on the local network would know what packets are being transmitted, where to or what they contain.

Unfortunately, this doesn't solve the real problem, just moves it upstream. Your VPN/encrypted link has to connect to the real network at some point and as soon as it does, you'll be forced to use correct routing information. You could mitigate this by moving IP blocks every so often / having multiple connections to the 'net but this could be complex to maintain.

An improved approach might be to use TOR to mask routing from your network. It's not perfect but it's another layer of defense.

So perhaps an SSL SMTP connection over your encrypted vpn to your mail server and encrypted email over TOR to the recipient(s) mail servers. (SSL on top of your VPN encryption to protect against other machines on the VPN. You may want to consider client certificates to guarantee the source of the email)

As to protecting the email itself, I'm definitely not an expert but...

Having just spotted your use case and Focusing purely on protecting the connection to the smtp server, I think it'll depend on how easy it is to uniquely configure the sensors.

If it's cheap, use a unique SSL client cert with each sensor. This will both secure the connection and confirm the ID of both parties - no spoofed sensors.

If it's costly to configure, use something PSK based - You still get the encryption but if one device is compromised, they all are [at least to anyone inside the VPN].

share|improve this answer
add comment

Source IPs - If you connect to a mail server you control, you can configure it to write fake source headers (does it really matter since you'll probably be using private network IP ranges for your senders machines?) - but the upstream mail server will see the real IP address for your immediate mail server. Whether or not it commits that information truthfully to the headers it writes is a different matter.

Destination IPs - At some point, they will need to appear in the clear to the MTAs that the email transits so that it can be properly routed. At that point, the MTAs handling that email will probably (as they should) write that information into the mail headers.

Encrypt the username - Presume this means securing the login process? Pass it through a secure tunnel.

Encrypting the email itself - depends on the sender and recipient email clients, and how much usability is required. You could go as far as just sending Truecrypted blobs back and forth as attachments, which requires no modifications to the email clients. Or as you mentioned, deploy a certificate-based system - the fine deployment details will depend very much on the email client, OS, and how much compatibility is needed (what happens when "outsiders" need to send or receive secure email?).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.