tarefa prática

86
Tarefa Prática Mozilla Thunderbird Email

Upload: emiko

Post on 23-Jan-2016

26 views

Category:

Documents


0 download

DESCRIPTION

Tarefa Prática. Mozilla Thunderbird Email. OpenPGP. OpenPGP is also based on PGP. S/MIME. S/MIME was originally developed by RSA Data Security , Inc. It is based on the PKCS #7 data format for the messages , and the X.509v3 format for certificates . - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Tarefa Prática

Tarefa Prática

Mozilla Thunderbird Email

Page 2: Tarefa Prática

OpenPGP

OpenPGP is also based on PGP.

Page 3: Tarefa Prática

S/MIME

S/MIME was originally developed by RSA Data Security, Inc.

It is based on the PKCS #7 data format for the messages, and the X.509v3 format for certificates.

PKCS #7, in turn, is based on the ASN.1.

Page 4: Tarefa Prática

PKCS#7

In cryptography, PKCS refers to a group of Public Key Cryptography Standards devised and published by RSA Security.

Cryptographic Message Syntax Standard. See RFC 2315. Used to sign and/or encrypt messages under a PKI. Used also for certificate dissemination (for instance as a

response to a PKCS#10 message - Certification Request Standard).

Formed the basis for S/MIME, which is now based on RFC 3852, an updated Cryptographic Message Syntax Standard (CMS).

Page 5: Tarefa Prática

PGP/MIME

PGP/MIME is based on PGP, which was developed by many individuals, some of whom have now joined together as PGP, Inc.

The message and certificate formats were created from scratch, and use simple binary encoding.

Page 6: Tarefa Prática

S/MIME, OpenPGP and PGP/MIME

PGP/MIME, S/MIME and OpenPGP use MIME to structure their messages.

They rely on the multipart/signed MIME type that is described in RFC 1847 for moving signed messages over the Internet.

A single mail client could conceivably accept and send both formats.

Page 7: Tarefa Prática

About Digital Signatures & Encryption

When you compose a mail message, you can choose to attach your digital signature to it.

A digital signature allows recipients of the message to verify that the message really comes from you and hasn't been tampered with since you sent it.

Page 8: Tarefa Prática

When you compose a mail message, you can also choose to encrypt it. Encryption makes it very difficult for anyone other than the intended recipient to read the message while it is in transit over the Internet.

Page 9: Tarefa Prática

Before you can sign or encrypt a message, you must take these preliminary steps: Obtain one or more certificates (the digital

equivalents of ID cards). For details, see Getting Your Own Certificate.

Configure the security settings for your email account. For details, see Configuring Your Security Settings.

Page 10: Tarefa Prática

Certificates

Page 11: Tarefa Prática

Getting Your Own Certificate

Much like a credit card or a driver's license, a certificate is a form of identification you can use to identify yourself over the Internet and other networks.

Page 12: Tarefa Prática

Getting Your Own Certificate

Like other commonly used personal IDs, a certificate is typically issued by an organization with recognized authority to issue such identification.

An organization that issues certificates is called a certificate authority (CA).

Page 13: Tarefa Prática

Getting Your Own Certificate

You can obtain certificates that identify you from public CAs, from system administrators or special CAs within your organization, or from web sites offering specialized services that require a means of identification more reliable that your name and password.

Page 14: Tarefa Prática

Getting Your Own Certificate

Just as the requirements for a driver's license vary depending on the type of vehicle you want to drive, the requirements for obtaining a certificate vary depending on what you want to use it for.

Page 15: Tarefa Prática

Getting Your Own Certificate

In some cases getting a certificate may be as easy as going to a web site, entering some personal information, and automatically downloading the certificate into your browser.

In other cases you may have to go through more complicated procedures.

Page 16: Tarefa Prática

Getting Your Own Certificate

You can obtain a certificate today by visiting the URL for a certificate authority and following the on-screen instructions. For a list of certificate authorities, see the online document Client Certificates.

Page 17: Tarefa Prática

Getting Your Own Certificate

Once you obtain a certificate, it is automatically stored in a security device. Your browser comes with its own built-in Software Security Device.

A security device can also be a piece of hardware, such as a smart card.

Page 18: Tarefa Prática

Getting Your Own Certificate

Like a driver's license or a credit card, a certificate is a valuable form of identification that can be abused if it falls into the wrong hands.

Once you've obtained a certificate that identifies you, you should protect it in two ways: by backing it up and by setting your master password.

Page 19: Tarefa Prática

Getting Your Own Certificate

When you first obtain a certificate, you may be prompted to back it up.

If you haven't yet created a master password, you will be asked to create one.

For detailed information about backing up a certificate and setting your master password, see Your Certificates.

Page 20: Tarefa Prática

Getting Your Own Certificate

Page 21: Tarefa Prática

Managing Certificates

You can use the Certificate Manager to manage the certificates you have available.

Certificates may be stored on your computer's hard disk or on smart cards or other security devices attached to your computer.

Page 22: Tarefa Prática

Managing Certificates

To open the Certificate Manager: Open the Edit menu (Mozilla menu on Mac OS

X) and choose Preferences. Under the Privacy & Security category, click

Certificates. (If no subcategories are visible, double-click Privacy & Security to expand the list.)

In the Manage Certificates section, click Manage Certificates. You see the Certificate Manager.

Page 23: Tarefa Prática

Managing Certificates that Identify You

When you first open the Certificate Manager, you'll notice that it has several tabs across the top of its window.

The first tab is called Your Certificates, and it displays the certificates your browser has available that identify you.

Your certificates are listed under the names of the organizations that issued them.

Page 24: Tarefa Prática

Managing Certificates that Identify You

To perform an action on one or more certificates, click the entry for the certificate (or Control-click to select more than one), then click the View, Backup, or Delete button.

Each of these buttons brings up another window that allows you to perform the action.

Click the Help button in any window to obtain more information about using that window.

Page 25: Tarefa Prática

Managing Certificates that Identify You

The following buttons under Your Certificates don't require a certificate to be selected. You use them to perform these actions: Import. Click this button if you want to import a

certificate that you've previously backed up or transferred from one machine to another.

Backup All. Click this button to back up all your own certificates stored in the Software Security Device.

Page 26: Tarefa Prática

Managing Certificates that Identify You

Certificates on smart cards cannot be backed up.

Whether you select some of your certificates and click Backup, or click Backup All, the resulting backup file will not include any certificates stored on smart cards or other external security devices.

You can only back up certificates that are stored on the built-in Software Security Device.

For more details about any of these tasks, see Your Certificates.

Page 27: Tarefa Prática

Managing Certificates that Identify Others

When you compose a mail message, you can choose to attach your digital signature to it.

A digital signature allows recipients of the message to verify that the message really comes from you and hasn't been tampered with since you sent it.

Page 28: Tarefa Prática

Managing Certificates that Identify Others

Every time you send a digitally signed message, your encryption certificate is automatically included with the message.

This certificate allows the message recipients to send you encrypted messages.

Page 29: Tarefa Prática

Managing Certificates that Identify Others

One of the easiest ways to obtain someone else's encryption certificate is for that person to send you a digitally signed message.

Certificate Manager automatically stores other people's certificates whenever they are received in this way.

Page 30: Tarefa Prática

Managing Certificates that Identify Others

To view all the certificates identifying other people that are available to the Certificate Manager, click the Other People's tab at the top of the Certificate Manager window.

You can send encrypted messages to anyone for whom a valid certificate is listed. Certificates are listed under the names of the organizations that issued them.

Page 31: Tarefa Prática

Managing Certificates that Identify Others

To perform an action on one or more certificates, click the entry for the certificate (or Control-click to select more than one), then click the View or Delete button.

Page 32: Tarefa Prática

Managing Certificates that Identify Others

Each of these buttons brings up another window that allows you to perform the action.

Click the Help button in any window to obtain more information about using that window.

For more details, see Other People's Certificates.

Page 33: Tarefa Prática

Managing Certificates that Identify Web Sites

Some web sites use certificates to identify themselves. Such identification is required before the web site can encrypt information transferred between the site and your computer (or vice versa), so that no one can read the data while in transit.

Page 34: Tarefa Prática

Managing Certificates that Identify Web Sites

If the URL for a web site begins with https://, the web site has a certificate.

If you visit such a web site and its certificate was issued by a CA that the Certificate Manager doesn't know about or doesn't trust, you will be asked whether you want to accept the web site's certificate.

When you accept a new web site certificate, the Certificate Manager adds it to its list of web site certificates.

Page 35: Tarefa Prática

Managing Certificates that Identify Web Sites

To view all the web site certificates available to your browser, click the Web Sites tab at the top of the Certificate Manager window.

Page 36: Tarefa Prática

Managing Certificates that Identify Web Sites

To perform an action on one or more web site certificates, click the entry for the certificate (or Shift-click to select more than one), then click the View, Edit, or Delete button.

Each of these buttons brings up another window that allows you to perform the corresponding action.

Page 37: Tarefa Prática

Managing Certificates that Identify Web Sites

The Edit button allows you to specify whether your browser will trust the selected web site certificates in the future.

For more details, see Web Site Certificates.

Page 38: Tarefa Prática

Managing Certificates that Identify Web Sites

Like other commonly used forms of ID, a certificate is issued by an organization with recognized authority to issue such identification.

An organization that issues certificates is called a certificate authority (CA).

A certificate that identifies a CA is called a CA certificate.

Page 39: Tarefa Prática

Managing Certificates that Identify Certificate Authorities

Certificate Manager typically has many CA certificates on file.

These CA certificates permit Certificate Manager to recognize and work with certificates issued by the corresponding CAs.

Page 40: Tarefa Prática

Managing Certificates that Identify Certificate Authorities

However, the presence of a CA certificate in this list does not guarantee that the certificates it issues can be trusted.

You or your system administrator must make decisions about what kinds of certificates to trust depending on your security needs.

Page 41: Tarefa Prática

Managing Certificates that Identify Certificate Authorities

To view all the CA certificates available to your browser, click the Authorities tab at the top of the Certificate Manager window.

Page 42: Tarefa Prática

Managing Certificates that Identify Certificate Authorities

To perform an action on one or more CA certificates, click the entry for the certificate (or Control-click to select more than one), then click the View, Edit, or Delete button.

Each of these buttons brings up another window that allows you to perform the action.

Click the Help button in any window to obtain more information about using that window.

Page 43: Tarefa Prática

Managing Certificates that Identify Certificate Authorities

The Edit button allows you to view and control the trust settings for each certificate. Trust settings for a CA certificate let you to specify which kinds of certificates issued by that CA you are willing to trust.

For more details, see Authorities.

Page 44: Tarefa Prática

Managing Smart Cards and Other Security Devices

A smart card is a small device, typically about the size of a credit card, that contains a microprocessor and is capable of storing information about your identity (such as your private keys and certificates) and performing cryptographic operations.

Page 45: Tarefa Prática

Managing Smart Cards and Other Security Devices

To use a smart card, you typically need to have a smart card reader (a piece of hardware) attached to your computer, as well as software on your computer that controls the reader.

Page 46: Tarefa Prática

Managing Smart Cards and Other Security Devices

A smart card is just one kind of security device. A security device (sometimes called a token) is a hardware or software device that provides cryptographic services and stores information about your identity. Use the Device Manager to work with smart cards and other security devices.

Page 47: Tarefa Prática

Managing Smart Cards and Other Security Devices

In this section:About Security Devices and ModulesUsing Security DevicesUsing Security ModulesEnable FIPS Mode

Page 48: Tarefa Prática

About Security Devices and Modules

The Device Manager displays a window that lists the available security devices.

You can use the Device Manager to manage any security devices, including smart cards, that support the Public Key Cryptography Standard (PKCS) #11.

Page 49: Tarefa Prática

Managing Smart Cards and Other Security Devices

A PKCS #11 module (sometimes called a security module) controls one or more security devices in much the same way that a software driver controls an external device such as a printer or modem.

If you are installing a smart card, you must install the PKCS #11 module for the smart card on your computer as well as connecting the smart card reader.

Page 50: Tarefa Prática

Managing Smart Cards and Other Security Devices

By default, the Device Manager controls two internal PKCS #11 modules that manage three security devices:

Page 51: Tarefa Prática

Managing Smart Cards and Other Security Devices

Mozilla Internal PKCS #11 Module: Controls two security devices:

Generic Crypto Services: A special security device that performs all cryptographic operations required by the Mozilla Internal PKCS #11 Module.

Page 52: Tarefa Prática

Managing Smart Cards and Other Security Devices

Software Security Device: Stores your certificates and keys that aren't stored on external security devices, including any CA certificates that you may have installed in addition to those that come with the browser.

Page 53: Tarefa Prática

Managing Smart Cards and Other Security Devices

Builtin Roots Module: Controls a special security device called the Builtin Object Token.

This security device stores the default CA certificates that come with the browser.

Page 54: Tarefa Prática

Managing Smart Cards and Other Security Devices

Page 55: Tarefa Prática

Using Security Devices

The Device Manager allows you to perform operations on security devices.

To open the Device Manager, follow these steps:

Page 56: Tarefa Prática

Using Security Devices

Open the Mozilla Edit menu and choose Preferences.

Under the Privacy & Security category, click Certificates. (If no subcategories are visible, double-click Privacy & Security to expand the list.)

In the Certificates panel, click Manage Security Devices.

Page 57: Tarefa Prática

Using Security Devices

The Device Manager lists each available PKCS #11 module in boldface, and the security devices managed by each module below its name.

Page 58: Tarefa Prática

Using Security Devices

When you select a security device, information about it appears in the middle of the Device Manager window, and some of the buttons on the right side of the window become available.

For example, if you select the Software Security Device, you can perform these actions:

Page 59: Tarefa Prática

Using Security Devices

Click Login or Logout to log in or out of the Software Security Device.

If you are logging in, you will be asked to supply the master password for the device.

You must be logged into a security device before your browser software can use it to provide cryptographic services.

Page 60: Tarefa Prática

Using Security Devices

Click Change Password to change the master password for the device.

Page 61: Tarefa Prática

Using Security Devices

You can perform these actions on most security devices.

However, you cannot perform them on the Builtin Object Token or Generic Crypto Services, which are special devices that must normally be available at all times.

For more details, see Device Manager.

Page 62: Tarefa Prática

Using Security Modules

If you want to use a smart card or other external security device, you must first install the module software on your computer and, if necessary, connect any associated hardware.

Follow the instructions that come with the hardware.

Page 63: Tarefa Prática

Using Security Modules

After a new module is installed on your computer, follow these steps to load it:

Open the Edit menu (Mozilla menu on Mac OS X) and choose Preferences.

Under the Privacy & Security category, click Certificates. (If no subcategories are visible, double-click Privacy & Security to expand the list.)

Page 64: Tarefa Prática

Using Security Modules

In the Certificates panel, click Manage Security Devices.

Click Load. In the Load PKCS #11 Module dialog box, click

the Browse button, locate the module file, and click Open.

Fill in the Module Name field with the name of the module and click OK.

Page 65: Tarefa Prática

Using Security Modules

The new module will then show up in the list of modules with the name you assigned to it.

To unload a PKCS #11 module, select its name and click Unload.

Page 66: Tarefa Prática

Enable FIPS Mode

Federal Information Processing Standards Publications (FIPS PUBS) 140-1 is a US government standard for implementations of cryptographic modules.

That is, hardware or software that encrypts and decrypts data or performs other cryptographic operations (such as creating or verifying digital signatures).

Many products sold to the US government must comply with one or more of the FIPS standards.

Page 67: Tarefa Prática

Enable FIPS Mode

To enable FIPS mode for the browser, you use the Device Manager: Open the Edit menu (Mozilla menu on Mac OS

X) and choose Preferences. Under the Privacy & Security category, click

Certificates. (If no subcategories are visible, double-click Privacy & Security to expand the list.)

Page 68: Tarefa Prática

Enable FIPS Mode

In the Certificates panel, click Manage Devices.

Click the Enable FIPS button. When FIPS is enabled, the name NSS Internal PKCS #11 Module changes to NSS Internal FIPS PKCS #11 Module and the Enable FIPS button changes to Disable FIPS.

To disable FIPS-mode, click Disable FIPS.

Page 69: Tarefa Prática

Controlling Validation

As discussed above under Get Your Own Certificate, a certificate is a form of identification, much like a driver's license, that you can use to identify yourself over the Internet and other networks. However, also like a driver's license, a certificate may expire or become invalid for some other reason. Therefore, your browser software needs to confirm the validity of any given certificate in some way before trusting it for identification purposes.

Page 70: Tarefa Prática

Controlling Validation

This section describes how Certificate Manager validates certificates and how to control that process. To understand the process, you should have some familiarity with public-key cryptography. If you are not familiar with the use of certificates, you should check with your system administrator before attempting to change any of your browser's certificate validation settings.

Page 71: Tarefa Prática

Controlling Validation

In this section:

How Validation Works Managing CRLs Configuring OCSP Validation Settings

Page 72: Tarefa Prática

Controlling Validation

How Validation Works

Whenever you use or view a certificate stored by Certificate Manager, it takes several steps to verify the certificate.

At a minimum, it confirms that the CA's digital signature on the certificate was created by a CA whose own certificate is

(1) present in the Certificate Manager's list of available CA certificates and

(2) marked as trusted for issuing the kind of certificate being verified.

Page 73: Tarefa Prática

Controlling Validation

How Validation Works

If the CA certificate is not itself present, the certificate chain for the CA certificate must include a higher-level CA certificate that is present and correctly trusted. Certificate Manager also confirms that the certificate being verified is currently marked as trusted in the certificate store. If any one of these checks fails, Certificate Manager marks the certificate as unverified and won't recognize the identity it certifies.

Page 74: Tarefa Prática

Controlling Validation

How Validation WorksA certificate can pass all these tests and

still be compromised in some way; for example, the certificate may be revoked because an unauthorized person has gained access to the certificate's private key. A compromised certificate can allow an unauthorized person (or web site) to pretend to be the certificate owner.

Page 75: Tarefa Prática

Controlling Validation

How Validation Works One way to combat this threat is for Certificate

Manager to check a certificate revocation list (CRL) as part of the verification process (see Managing CRLs, below). Typically, you download a CRL to your browser by clicking a link. If a CRL is present, Certificate Manager checks any certificate issued by the same CA against the list as part of the verification process.

Page 76: Tarefa Prática

Controlling Validation

How Validation Works

The reliability of CRLs depends on the frequency with which they are both updated by a server and checked by a client. You can configure your Automatic CRL Update Preferences so that a CRL will be updated automatically at regular intervals with the version currently on the server.

Page 77: Tarefa Prática

Controlling Validation

How Validation Works

Another way to combat the threat of compromised certificates is to use a special server that supports the Online Certificate Status Protocol (OCSP). Such a server can answer client queries about individual certificates (see Configuring OCSP, below).

Page 78: Tarefa Prática

Controlling Validation

How Validation Works

The server, called an OCSP responder, receives an updated CRL periodically from the CA that issues the certificates to be verified.

You can configure Certificate Manager to submit a status request for a certificate to the OCSP responder, and the OCSP responder confirms whether the certificate is valid.

Page 79: Tarefa Prática

Controlling Validation

Managing CRLsA certificate revocation list (CRL) is list of

revoked certificates. A certificate authority (CA) might revoke a

certificate, for example, if it has been compromised in some way—much the way a credit card company might revoke your credit card if you report that it's been stolen.

Page 80: Tarefa Prática

Controlling Validation

Managing CRLsThis section describes how to import and

manage CRLs. For background information, see How

Validation Works. For detailed descriptions of CRL settings

that you can control, see Validation Settings.

Page 81: Tarefa Prática

Controlling Validation

Managing CRLs

In this section: About the "Next Update" Date Importing CRLs Viewing and Managing CRLs 

Page 82: Tarefa Prática

Controlling Validation

Importing CRLsYou can import the latest CRL from a CA

into your browser. To import a CRL, follow these steps: Go to the URL specified by the CA or by your

system administrator and click the link for the CRL that you want to import.

The Import Status dialog box appears.

Page 83: Tarefa Prática

Controlling Validation

The next step depends on whether you click Yes or No in the Import Status dialog box:

Yes: The Automatic CRL Update Preferences dialog box appears. In this case, go on to step 4.

No: The Import Status dialog box closes. If you change your mind and decide to enable automatic updates after all, see Viewing and Managing CRLs. The Import Status dialog box appears.

Page 84: Tarefa Prática

Controlling Validation

Confirm that the CRL was imported successfully and that it's the one you wanted. In most cases you should also click Yes, which enables automatic updating of the CRL you just imported.

Page 85: Tarefa Prática

Controlling Validation

Select the option labeled "Enable Automatic Update for this CRL".

Decide how you want to schedule the automatic updates: Update __ days before Next Update date:

Select this option if you want to base the update frequency on the frequency with which the CRL publisher publishes a new version of the CRL.

Page 86: Tarefa Prática

Controlling Validation

Update every __ days: Select this option if you want to specify an update interval unrelated to the CRL's Next Update date.

Click OK to confirm your choices.