Security: Who's Got the Key?

Companies must communicate with the outside world by e-mail. Yet the thought of moving company data freely to and from a company network is frightening to information technology (IT) managers. In a typical intranet, valuable company data is shielded from the outside by a firewall, which sits between the network and an externally accessible server. Nothing gets through -- except e-mail.

Existing encryption schemes, such as RSA, can ensure secure transmission of data. In fact, an extension for encryption to the MIME format, S/MIME, is based on RSA and has broad industry support, but there's a catch. Encryption requires two keys, public and private. The private key encodes the message, and the p ublic key decodes it. The recipient must have access to the public key to understand the message. ( See the figure. )

Some trusted entity must hold those keys in escrow and assign certificates that act as a digital signature, identifying users of those keys. That entity is as yet undetermined. It could be a government body, such as the U.S. Post Office, or an independent organization set up explicitly for the purpose. Verisign (Mountain View, CA) is a commercial enterprise that handles certificates. Some messaging products, such as Netscape's SuiteSpot 3.0, come with a certificate server for internal use. Third-party products, such as Nortel's Entrust, also allow companies to build internal certificate-management applications. To ensure compatibility from one certification scheme to another, companies will likely cross-certify, according to Ron Rosenthal, director of new initiatives at Harbinger Enterprise Solutions (Atlanta, GA), a vendor of electronic -commerce products and services.

The dilemma: Companies can build and manage internal certificate systems -- which gives them control, but at the cost of added administrative overhead -- or they can off-load that chore to a third party but lose the security of controlling the distribution of certificates. For many companies, neither choice is satisfactory.

---

Messaging Security

illustration_link (78 Kbytes)