Network Security: Email and DNS

Network Security - Electronic Mail and Domain Name System

• The lecture was given by Prof. Dr. Torsten Braun at the University of Bern.
• The session dates were November 25, 2024 - December 2, 2024.
• The lecture covers Electronic Mail and Domain Name System (DNS).

Email Protocols and Modules

• Message Transfer Agent (MTA): Operates on behalf of user actors and applications, formats messages, and performs initial system submission (MSA).
• Mail Submission Agent (MSA): Accepts messages from MUAs, enforces the policies of the hosting domain.
• Message User Agent (MUA): Processes messages, stores messages, and displays information to the user.
• Mail Delivery Agent (MDA): Transfers messages from the Message Handling System to the Message Store.
• Message Store (MS): A place to store and retrieve messages.
• SMTP: Simple Mail Transfer Protocol is the standard protocol for sending email between servers.
• ESMTP: Enhanced SMTP, an extension of SMTP supporting features like authentication and larger message sizes.
• POP3: Post Office Protocol version 3. Used by email clients to download mail from a mail server (TCP port 110).
• IMAP: Internet Message Access Protocol. Used by email clients to access mail on a mail server (TCP port 143).
• RFC 822/5322 Format: Includes header fields like Message-ID, Date, From, To, Subject etc.

Email Threats and Mitigations

• Authenticity: Verification of the sender of the email. (e.g., compromised server)
• Integrity: ensuring that the email content hasn't been modified during transit. (e.g., malware)
• Confidentiality: Ensuring emails privacy (e.g. Data Leak).
• Availability: Ensuring emails will be available/accessible. (e.g., Denial of Service attack)
• Domain-Based Message Authentication, Reporting, and Conformance (DMARC): Allows email senders to specify policies on how their mails are handled, including reporting mechanisms and frequency for reports send by receivers.
• Sender Policy Framework (SPF): A mechanism utilized by sending domains to identify and confirm the senders for emails.
• Domain Keys Identified Mail (DKIM): Enhances security and integrity of mailed messages, enabling the sending domain to cryptographically sign (selected) headers and body.

Pretty Good Privacy (PGP)

• PGP uses cryptographic techniques to encrypt and digitally sign emails for enhanced security.
• PGP operates on Web of Trust rather than closed groups.

Secure/Multipurpose Internet Mail Extensions (S/MIME)

• S/MIME utilizes a hierarchical CA system, much like TLS.
• PGP employs distinct cryptographic methods compared to S/MIME.

DNS

• A comprehensive directory service mapping hostnames to corresponding IP addresses.
• It utilizes a hierarchical structure for managing names, employing a distributed database organization.
• DNS records, such as A, AAAA, CNAME, MX, NS, and PTR records, aid in domain configuration and IP address lookup.

DNS Security Extensions (DNSSEC)

• DNSSEC provides end-to-end security mechanisms using digital signatures to bolster confidence in DNS records.
• It combats various threats to the DNS by relying upon digital signatures supplied by zone administrators.

DNS-Based Authentication of Named Entities (DANE)

• DANE aims to securely authenticate TLS certificates, binding them to related DNS names using DNSSEC, eliminating the need for Certification Authorities.

Email Formats

• MIME (Multipurpose Internet Mail Extensions): Enables encoding of various content types in email messages, encompassing text, pictures, and other forms suitable for multimedia email.
• RFC 5322's SMTP limitations: Unencrypted channels for transmission and lack of provisions for handling binary files or national language characters.