Privacy-enhanced Electronic Mail
Encyclopedia
Privacy Enhanced Mail is a 1993 IETF
proposal for securing email using public-key cryptography
. Although PEM became an IETF proposed standard it was never widely deployed or used.
One reason for the lack of deployment was that the PEM protocol depended on prior deployment of a hierarchical public key infrastructure
(PKI) with a single root. Deployment of such a PKI proved impossible as the operational cost and legal liability of the root and 'policy' CAs
became understood.
In addition to being an obstacle to deployment the single rooted hierarchy was rejected by some commentators as an unacceptable imposition of central authority. This led Phil Zimmermann
to propose the Web of Trust
as the PKI infrastructure for PGP
.
Attempts to deploy PEM were finally abandoned in response to the need to extend the protocol to support MIME
leading to the development of MOSS
(never widely implemented; now abandoned) and S/MIME
(shares de facto standard status with PGP).
RFC 1422: Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management
RFC 1423: Privacy Enhancement for Internet Electronic Mail: Part III: Algorithms, Modes, and Identifiers
RFC 1424: Privacy Enhancement for Internet Electronic Mail: Part IV: Key Certification and Related Services
Internet Engineering Task Force
The Internet Engineering Task Force develops and promotes Internet standards, cooperating closely with the W3C and ISO/IEC standards bodies and dealing in particular with standards of the TCP/IP and Internet protocol suite...
proposal for securing email using public-key cryptography
Public-key cryptography
Public-key cryptography refers to a cryptographic system requiring two separate keys, one to lock or encrypt the plaintext, and one to unlock or decrypt the cyphertext. Neither key will do both functions. One of these keys is published or public and the other is kept private...
. Although PEM became an IETF proposed standard it was never widely deployed or used.
One reason for the lack of deployment was that the PEM protocol depended on prior deployment of a hierarchical public key infrastructure
Public key infrastructure
Public Key Infrastructure is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate...
(PKI) with a single root. Deployment of such a PKI proved impossible as the operational cost and legal liability of the root and 'policy' CAs
Certificate authority
In cryptography, a certificate authority, or certification authority, is an entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate...
became understood.
In addition to being an obstacle to deployment the single rooted hierarchy was rejected by some commentators as an unacceptable imposition of central authority. This led Phil Zimmermann
Phil Zimmermann
Philip R. "Phil" Zimmermann Jr. is the creator of Pretty Good Privacy , the most widely used email encryption software in the world. He is also known for his work in VoIP encryption protocols, notably ZRTP and Zfone....
to propose the Web of Trust
Web of trust
In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to establish the authenticity of the binding between a public key and its owner. Its decentralized trust model is an alternative to the centralized trust model of a public key infrastructure ,...
as the PKI infrastructure for PGP
Pretty Good Privacy
Pretty Good Privacy is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security...
.
Attempts to deploy PEM were finally abandoned in response to the need to extend the protocol to support MIME
MIME
Multipurpose Internet Mail Extensions is an Internet standard that extends the format of email to support:* Text in character sets other than ASCII* Non-text attachments* Message bodies with multiple parts...
leading to the development of MOSS
MIME Object Security Services
MIME Object Security Services is a protocol that uses the multipart/signed and multipart/encrypted framework to apply digital signature and encryption services to MIME objects.-Details:...
(never widely implemented; now abandoned) and S/MIME
S/MIME
S/MIME is a standard for public key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFCs. S/MIME was originally developed by RSA Data Security Inc...
(shares de facto standard status with PGP).
External links
RFC 1421: Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication ProceduresRFC 1422: Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management
RFC 1423: Privacy Enhancement for Internet Electronic Mail: Part III: Algorithms, Modes, and Identifiers
RFC 1424: Privacy Enhancement for Internet Electronic Mail: Part IV: Key Certification and Related Services
See also
- E-mail privacyE-mail privacyThe protection of email from unauthorized access and inspection is known as electronic privacy. In countries with a constitutional guarantee of the secrecy of correspondence, email is equated with letters and thus legally protected from all forms of eavesdropping.In the United States, privacy of...
- Privacy-enhancing technologies
- I2P-Bote (an anonymous secure e-mail system, not with PEM, but end-to-end encrypted and authenticated)