Certificates, e-signature, encryption

As we have no doubt all experienced on more than one occasion, email in its basic form is not among the most secure or reliable means of communication. It can be a vehicle for unwanted and intrusive advertising, and often contains dangerous content designed to manipulate or mislead the recipient. It frequently travels across the globe via many different servers, which do not always guarantee the confidentiality of the content being sent. Of course, there are many more issues relating to the broadly understood security of email communication, but the nuisance caused by some of those mentioned above can be significantly reduced by making the widest possible use of electronic signatures within our academic community.

Once an electronic signature has been installed in an email client, the process of using it is extremely simple and does not in the slightest hinder normal, day-to-day work. We usually have two options here. We can either simply sign the email we are about to send with a single click, or additionally encrypt it so that only the intended recipient can read it correctly.

Without delving into mathematical nuances or discussions about the strength of encryption algorithms, we can say, on a purely practical level, that the act of signing alone gives the recipient a significantly greater level of certainty that the message really does come from us and that not a single letter has been altered anywhere along the way since it was sent.

By adding encryption, we make our message completely unreadable to anyone who might manage to intercept it. Even opening an email programme on a compromised or stolen computer will not allow the content to be read unless the attacker or thief gains access to the password-protected encryption key.

And in this way, we achieve the three elements essential for professional communication: non-repudiation, integrity and confidentiality of the transmitted content. It is also worth noting that this easy-to-use (though algorithmically very complex) encryption covers, in one go, both the body of the message and any attachments, regardless of their type. Furthermore, the encryption algorithms used fall into the category of strong security measures.

If the benefits of using an e-signature outlined above have convinced you to give it a try, we should now look at certain conditions that must be met in order to communicate whilst fully utilising its advantages.

Since time immemorial, the greatest obstacle to establishing encrypted communication has been the initial, confidential and tamper-proof transmission of the encryption method or password. This dilemma was resolved quite some time ago by asymmetric cryptography, which provides both parties to a dialogue with a pair of encryption keys: a private (secret) key and a public (publicly available) key. Again, leaving aside the technical details, the first task for the correspondents is to exchange their public keys securely and reliably. This is done by sending each other unencrypted, but signed, messages. Once this has been done, we can then encrypt all communication with our correspondent. Of course, both parties must also be certain that the recipient’s key has not been spoofed by a forger. We achieve this by encapsulating our own public key within a sort of ‘capsule’ known as a certificate, the authenticity of which can be automatically verified.

One final practical point to bear in mind is the limited validity period of these certificates, which means we have to renew them periodically.

Some of the steps described are simplified somewhat by the Certus system. Among other things, it allows us to obtain respondents’ encryption keys in a different, more convenient way, and also helps to monitor the expiry dates of certificates, although its primary function is the automation and user-friendliness of generating new certificates for AGH staff.

Our certificates are provided by Harica, a globally recognised Greek operator, with whom Polish universities collaborate as part of the Pionier consortium.

To summarise, here’s what you need to do to start using e-signatures and email encryption:

1. Log in to the Certus application using AGH SSO.
2. Generate a new certificate for yourself in the Certus application, following the instructions.
3. Install the downloaded certificate in your email client (using the documentation or IT Support).

Please note: the digital signature is not available in the web-based email version, i.e. on the poczta.agh.edu.pl portal, but it works, for example, in Thunderbird (recommended), Classic Outlook or Apple Mail.

4. Set your email client to sign all messages by default (recommended) or to use this option selectively on demand.
5. Encrypt messages sent via your email client to AGH staff, particularly those containing sensitive data.
6. Use your email programme as before, whilst bearing in mind its new capabilities and paying attention to any visual warnings should the security of a message raise concerns.
7. Ensure that your e-signature certificate is renewed; the Certus application will be very helpful in this regard.