crypto4c-ch15-电子邮件安全讲诉.ppt

邮件安全 电子邮件是最普及最重要，同时也最受安全问题困扰的互联网应用之一。 电子邮件的特点是离线方式(非交互)，因此解决其安全问题的方法是静态的，便于学习、分析和借鉴。 15.a SMTP/POP3 SMTP 制做假冒邮件 POP3 IMAP,X.400,… E-Mail: @ SMTP RFC 821 SMTP - Simple Mail Transfer Protocol POP3 RFC 1939 POP3 - Post Office Protocol – V3 IMAP RFC 2060 Internet Message Access Protocol allows a client to access and manipulate electronic mail messages on a server X400 X400 is a whole of protocols adapted to EDI E-Mail software * Client: Outlook/Exp, Foxmail, Eudora * Server: Sendmail, Exchange, Exim, Qmail, Postfix SMTP Server Survey // 958 All 401 UNIX Sendmail 176 Windows Microsoft Exchange or IIS SMTP 167 UNIX qmail 57 Windows Ipswitch IMail 23 UNIX smap 15 UNIX IBM Postfix, formerly VMailer 14 UNIX Exim 12 Windows Gordano NTMail SMTP Simple Mail Transfer Protocol RFC 821 /rfcs/rfc821.html /rfcsearch.html ESMTP (Extensions) RFC 1869 Command HELO、MAIL、RCPT、 DATA、SEND、SOML、 SAML、RSET、VRFY、 EXPN、HELP、NOOP、 QUIT、TURN、… SMTP model ++ ++ ++ | | | | | User |--| | SMTP | | ++ | Sender- |Commands/Replies| Receiver-| ++ | SMTP || SMTP | ++ | File |--| | and Mail | |--| File | |System| | | | | |System| ++ ++ ++ ++ Sender-SMTP Receiver-SMTP Model for SMTP Use Extended SMTP rfc1869 - SMTP Service Extensions EHLO (Extended HELLO) rather than HELO SMTP会话 SMTP Session HELO\015\012 MAIL FROM:abc@none\015\012 RCPT TO:xyz@where\015\012 DATA\015\012 Subject:test-sub\015\012\015\012 the_msg_body\015\012\056\015\012 QUIT\015\012 * 以TCP连接SMTP server的25号端口，发送此序列即可发出简单的邮件 SMTP试验 用telnet发信 找个不要口令即可发信的SMTP服务器 open relay 步骤见备注行 编程 MAIL API in Windows 在CGI/网页中发送邮件 在VBS脚本中发送 POP3 Version 3 of the Post Office Protocol. POP3 is defined in RFC 1081. POP3 allows a client computer to retrieve electronic mai