Why and how to encrypt

Why encrypting emails

The emails you send today are transmitted over the Internet machine to machine without any protection or privacy: exactly like postcards.

Thus, your colleagues, your email administrator, your access provider, equipment which provide for the transit of data over the Internet, the provider of your correspondent, his email administrator, his staff, all those equipments or people may read your emails.

Using CryptoMailer, your messages will be encrypted.

So your messages can be intercepted ... but they are unreadable, except for your recipient who holds the secret to decipher them.

How to encrypt

Whenever a file is encrypted by CryptoMailer, a random key is created. This key is protected by a protection key derived from a user password. This password can be chosen from the list or entered manually.

This way, the same document encrypted several times with the same password gives different results. It is therefore impossible to decrypt a document for someone who does not know the password.

Brute force

To find the password, a method of "brute force" can be used. This method consists of trying all possible strings. So depending on complexity of the password, the brute force method is quickly becoming useless, due to the extremely high number of combinations to test.

Assuming the password "k5L;@y=P". To find this password composed of eight characters, an attacker must try all possible codes between 1 and 8 characters, to have the chance to find it.

Consider that there are 112 characters "easily" accessible by a computer keyboard: the tiny, capital letters, numbers, accented characters, punctuation and other symbols. There is no less than 2.5 x 10e +16 codes of eight characters (25 million billion). Assuming that the pirate has a system of computers that allows him to test and verify a million codes per second, it will have nearly 800 years to test all possible codes.

Dictionary

For obvious reasons, there are few people who choose a password like "k5L;@y=P". The hackers thus prefer another method called "Dictionary" attacks.

In a dictionary attack, hackers do not test a sequence of random characters, but likely channels: all words of the English language, names, names, and their combination with some figures e.g."Virginia" and "Jerusalem" will be systematically tested, and probably "virginie35" too.

Such dictionaries exist in all languages, and are fairly easy to find on the internet. Therefore, assuming that the dictionary includes 50000 words, it would need a sentence of at least 3 words to obtain a satisfactory level of security.

Indeed, there are 2.5 billion possible combinations of two words among 50000. With a computer system capable of achieving 1 million operations per second, it will take less than 42 minutes to test them all.

Anyway, even if the string is longer, "strongly holidays" protects much less that "k5L;@y=P". But without doubt, "strongly holidays" provides an adequate level of protection for day to day operations.

Recommendations: It is recommended that meet certain safety rules concerning the composition of passwords.