Giao thông vận tải lớp bảo mật trực tiếp vào quá trình quá trình bảo mật giữa các máy. Hầu hết các đề án được thiết kế cho giao thức TCP để cung cấp thông tin liên lạc đáng tin cậy, hướng kết nối. Nhiều vận chuyển lớp cơ chế bảo mật yêu cầu thay đổi trong các ứng dụng truy cập | Internet Security Applications Chapter 4 137 How S MIME Works In order to send an S MIME secured message both the sender and recipient must have an S MIME-capable client such as Outlook Outlook Express or Netscape Communicator. Indeed one of the advantages of S MIME is that the sender and receiver of an e-mail do not need to run the same mail package. A list of products that have passed S MIME interoperability testing is available at standards smime . In addition each user must obtain a digital certificate with a corresponding private key. S MIME is a hybrid encryption system that uses both public and private key algorithms. Public key cryptography is too slow to use for encrypting bulk data but it is difficult to distribute private keys securely without public key cryptography. In the S MIME standard public key cryptography is used for symmetric key exchange and for digital signatures. S MIME requires the use of digital certificates discussed earlier in this chapter. The S MIME specification recommends the use of three encryption algorithms DES Triple-DES and RC2. The security of an S MIME encrypted message largely depends upon the key size of the encryption algorithm. An interesting aspect of S MIME is that the receiver not the sender of a message determines the encryption method used based on information provided in the digital certificate. Sending an S MIME message involves several steps. First someone wishes to send an encrypted e-mail that will be safe from eavesdroppers. The message is encrypted with a randomly generated symmetric session key. Next this session key is encrypted using the recipient s public key. This key was either previously exchanged or it was pulled from a directory such as an LDAP server. Next the encrypted message the session key algorithm identifiers and other data are all packaged into a PKCS 7-formatted binary object. This object is then encoded into a MIME object using the application .
