Software

Ask something
Question Locked

send encrypted message to external recipient with outlook 2003

0 helpful
7 replies

by mlepage

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello to all of you

At the company where I work, a client requested that all e-mail coomunicaiton between them and us should be encrypted. They specify that that they use PGP 8.1 (www.pgp.com)

Tell me if I'm wrong.

If I understand correctly. I have to use the same program to be able to send encrypted messages to them and read their encrypted messages.

If they use PGP 8.1 and we decide to use for example CGeep, it will not work

Just sending the public key to the other party is not enough.

Thank you in advance for your help

Michel

7 replies

by nepenthe0

For PGP to work, each party must have the installed software. The [i]Public Key[/i] is posted on the host server. Each party keeps the [i]Private Key[/i] secure.

Once PGP is installed, any message can be encrypted. It helps to send the [i]Public Key[/i] along with the encrypted message, because this saves the recipient the hassle of looking up the [i]Public Key[/i] on the host server.

I have used Zimmermann's program, and it keeps getting better. Keep in mind that encryption is only as safe as the [i]Private Key[/i]. Zimmermann recommends backing up the [i]Private Key[/i] (to an external HD, USB flash drive, CD) so that it can be recovered in the event of a computer crash.

Bottom line: you lose the [i]Private Key[/i], and you will [b]never[/b] be able to decrypt a previously encrypted memorandum.

Rick/Portland, OR

by robo_dev

They have the capbility of using the PGP 'PDF messenger' or 'web-email interface', so they could send encrypted email to you, and you could read it without any client software on your end.

To send encrpyted mail to them, you would need either 'PGP desktop email' or the 'PGP universal gateway'.

The advantage of the gateway is that no client software is needed.

by nepenthe0

[i]robo_dev[/i] - I have no personal experience with PGP [i]Universal Gateway[/i]. If the [i]private key[/i] is sent with the encrypted message, that suggests a rather unsatisfactory state of affairs, because an intercepted message could then conceivably be decrypted by a snoop.

How is PGP able to safeguard the recipient's [i]Private Key[/i]?

Rick/Portland, OR

by robo_dev

"For users without email encryption software, PGP Universal Gateway Email can be configured to deliver email through the PGP Universal Satellite thin client or using the PGP Universal Web Messenger webmail interface."

The PDF express piece works in a similar manner, sending an encyrpted PDF,

For cases where the decryption password has not been given to the recipient already, it also adds a small HTML attachment to the email, which, when opened by the recipient, retrieves the decryption password from the Universal Gateway's web server.

This HTML hit also counts as a ?certified delivery? token for compliance and auditing purposes, according to PGP director of product management John Dasher.

"Using PGP Universal Web Messenger, PGP Universal Gateway Email retains the original secure message and sends an ?in-the-clear? email message notifying the recipient that a secure message is available.

The PGP Universal Web Messenger feature allows recipients to use their Web browser to create a secure SSL/TLS session and retrieve their message through a webmail-like session served by PGP Universal Gateway Email.

by nepenthe0

The epoch-making breakthrough by Diffie & Hellman of [i]split-key[/i] encryption paved the way for all the electronically secure transactions we do today.

The first commercial application was published by RSA the following year. Until about 1997, RSA had the exclusive patent (patents expire at 20 years).

In all the [i]split-key[/i] encryption algorithms, the [i]private key[/i] never leaves the sender. Until the Diffie-Hellman breakthrough, the key had to be sent by messenger (throughout history), and the messenger could be captured and searched.

So I'm puzzled, because this sounds like a pre Diffie-Hellman venture that makes no sense, nor does the PGP explanation hold up under scrutiny. Any time a key is sent, it can be intercepted. The PGP [i]Messenger[/i] delivers the equivalent of the [i]Private Key[/i]...

Rick/Portland, OR

by robo_dev

So, I believe, the decryption is really being done at the sender, since what you're getting is just a link that says 'you've got an encrypted message'.

What you're doing, really, is just a SSL encrypted webmail session on the sender's email host/webserver.

Nothing is really being 'sent' other than the link back to their webserver. It's sort of similar to the embedded links in those phishing emails.

This discussion is closed to new replies.