Exchange Server 2010 : Ensuring Message Integrity (part 1) - Using S/MIME Extensions

To implement secure messaging, you need to be able to guarantee integrity, confidentiality, and authentication. It is possible to send a message in a tamperproof envelope but in clear text that anyone can read. It is possible to encrypt a message so that it cannot be read by an unintended user but fail to protect its integrity so that someone could delete part of it even if he or she could not read it. A message that is encrypted and tamperproof remains insecure if there is no method of confirming that it came from the sender that it purports to come from. Preferably, both sender and recipient should be authenticated so that not only can the recipient determine the message was sent by the identified sender but the sender can ensure that the message has been received by the identified recipient.

1. Using S/MIME Extensions

Public key cryptography uses a mathematically related key pair—a secret private key and a published public key—to protect the authenticity of a message. It creates a digital signature of a message using the private key, which can be verified using the public key. It also allows protection of the confidentiality and integrity of a message by encrypting the message using the public key. The message can then be decrypted only by using the private key.

S/MIME is a standard for public key encryption and signing of MIME data. S/MIME provides authentication, message integrity and nonrepudiation of origin (using digital signatures), and privacy and data security (using encryption).

Before you can use S/MIME for public key cryptography, you need to obtain and install a certificate either from your organization’s internal certificate authority (CA) or from a trusted third-party CA. An internal certificate can be used in-house only, as it is not trusted by external organizations. Typically, S/MIME clients require the installation of a certificate before permitting users to send encrypted messages.

1.1. OWA and S/MIME

A public key infrastructure (PKI) uses digital certificates to verify and authenticate the validity of each participant in an electronic transaction. You need to install Certificate Services on a member server in your organization to deploy a Windows PKI. A PKI enables your organization to publish its own certificates. Clients can request and receive certificates from a PKI on the internal network, and the PKI can renew or revoke certificates.

OWA users can use S/MIME to encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (a certificate) can read them. Users digitally sign a message, which enables its recipients to verify the identity of the sender and that the message has not been tampered with.

Users must have a digital ID and must install the S/MIME control for OWA before they can send encrypted and digitally signed messages or read encrypted messages using the OWA client. The S/MIME control is necessary to verify the signature on a digitally signed message. It is installed on a client computer by using the SMIME tab in Options. When they use S/MIME, users have access to features that are not otherwise available in OWA. They can, for example, do the following:

• Attach messages to other messages

• Paste images into messages

• Attach multiple files in a single operation

However, if the S/MIME control is installed in OWA, WebReady document viewing works in only clear-signed messages, not in encrypted messages or opaque-signed messages. When certain content types are sent from Outlook as S/MIME messages, they are not displayed in OWA. In such cases, OWA displays a banner in the message header. When a user opens a folder in another mailbox or uses explicit sign-in to open another user’s mailbox, most S/MIME features are not available. In such cases, the only S/MIME feature that is available is verification of digital signatures.

You can use the Exchange Management Console (EMC) or the Exchange Management Shell (EMS) to enable or disable S/MIME in OWA. To use the EMC, carry out the following procedure:

By default, S/MIME is enabled. To use the EMS to disable S/MIME on the OWA virtual directory in the default Internet Information Services (IIS) website on the local server, enter the following command:

Set-OWAVirtualDirectory -Identity "owa (Default Web Site)" -SMimeEnabled $false

					  

To enable S/MIME when it has previously been disabled, enter the following command:

Set-OWAVirtualDirectory -Identity "owa (Default Web Site)" -SMimeEnabled $true

					  

Neither of the previously listed EMS commands generates an output. If the command completes without error, the change has been made.

You manage S/MIME for OWA by using the Regedit utility to edit the registry on an Exchange Server 2010 Client Access server. Changes are made on a per-server basis, and if you have more than one Client Access server and you need the same S/MIME behavior on all such servers, you need to make the same changes on each server. Changes to the S/MIME settings in the registry take effect immediately. Users do not need to sign out or to restart any services.

The registry settings that control S/MIME behavior on a Client Access server can be found by accessing the following registry key:

HKLM\System\CurrentControlSet\Services\MSExchange OWA\SMIME

As shown in Figure 2, the settings that control S/MIME are not in the registry by default, and you need to add them. Table 12-1 shows some of the settings you can use. This list is not exclusive.

CLEAR AND OPAQUE-SIGNED EMAIL MESSAGES

Clear-signed email messages are larger than opaque-signed (encrypted) messages, but they can be opened and read using most email clients, including clients that do not support S/MIME.

Warning:

Edits to the registry take effect immediately without requiring confirmation. Take care when editing the registry.