Homework #1

You must submit your work to your instructor before midnight on due date. Failure to do so will result in late penalties, see the syllabus for grading detail.

The purpose of this homework is to give you a chance to get familiar with using digital certificates to encrypt and sign email.

Here is what you have to do:

• Download and install Thunderbird, an email client, from
• Start Thunderbird and create an account that will allow Thunderbird to connect to your email account on IIT's mail server. Here are the settings:
  • Your name: obviously your name
  • Email address: your student email address
  • Incoming server type: IMAP
  • Incoming server name: email.iit.edu
  • Incoming user name: your username on IIT's email server; for example, if your name is John Smith, then your username is smitjoh (though variations are possible depending on how many other students have the same name)
  • Account name: IIT (or whatever else you want)
• Select "Edit" and then "Account Settings"
• In the window that opens click on "Server Settings" and the select "SSL" for security settings; this means all communications between your email client and the email server will be encrypted
• Close the window

You can now check your email on the IIT server, download it locally if you so desire, or compose email and send it. However, the email you're sending is not encrypted, even though the communication channel between you and IIT's email server is. If you're sending information that's sensitive, then this is a problem.

Part (i), 10 points: Explain why the sensitive information you're sending in email is not secure even though all communications between your email client and the server are encrypted. Include your explanation in the email your're sending in part (iii) of this assignment.

You are now going to get a free digital certificate from one reputable provider on the Internet such as Thawte. Here is what you're going to request:

• X.509 certificate for Mozilla Firefox/Thunderbird

Follow the instructions to install the certificate; the certificate will be installed in your Firefox browser. You have to go through one extra step before you can use it in email. Here are the steps:

• In your Firefox browser go to "Edit" and then click "Preferences"
• Select the "Advanced" tab in the window that opens, then "Encryption" and "View certificates"
• Highlight the "Thawte Freemail Member" certificate, then click "Backup"; make a note of the location where you backed-up the certificate
• In Thunderbird go to "Edit" and then click "Preferences"
• Select the "Advanced" tab in the window that opens, then "Certificates", "View Certificates" and "Your Certificates"
• Click on "Import" to import the Digital Certificate into Thunderbird; navigate to the location where you saved the certificate earlier, then select the certificate to import and click Ok
• That's it, you're done and should be able now to encrypt and sign the contents of your email

Part (ii), 10 points: Send your instructor an email (digitally) signed only. In the email include a memorable quotation that you like. Also, in the same email, describe whether you can send an encrypted email to your instructor or not; if not, then explain why.

Part (iii), 10 points, due no more than 48 hours after your instructor replies to your email from Part (ii): Send your instructor an email that's encrypted AND signed. In the email include the following:

• The answer to part (i) above
• An explanation of what you found hard about getting this assignment done.