EuPEM

PEM plug-in for Eudora
(version 1.2a)

User Manual

Functionality

EuPEM, is a plug-in for Eudora that supports authentication and non-repudiation of the sender as well as integrity and confidentiality the transmitted data, according to the Privacy Enhanced Mail (PEM) mechanism (described in Internet RFCs 1421 -1424)  which is implemented in the SECUDE package. It is capable of :

•	Digitally signing and (optionally) encrypting outgoing e-mail messages.
•	Recognizing, validating and (if necessary) decrypting incoming PEM messages, displaying the validation results to the user and updating the user’s Personal Security Environment (PSE), according to the validation results.
•	Requesting a certificate from a Certification Authority (CA) of the user’s choice.
•	Upon receiving the certification reply from the corresponding CA, installing the new certificate and other certification-related information in the user’s PSE. 

Installation of the plug-in

1.	To be able to use the plug-in you need Windows 95/NT and Eudora Pro or Light version 3.x. 

2.	Install the SECUDE package version 5.1 (SECUDE.EXE and SECUDE.DLL).
[Download from http://www.darmstadt.gmd.de/secude].
Make sure that SECUDE.DLL resides in your windows/system directory.

3.	Copy the EUPEM.DLL (extracted from the eupem1_2.zip archive) to your Eudora plugins directory.

Using the plug-in

To use the plug-in you need a Personal Security Environment (PSE). In case you do not have one, use the SECUDE command to create it:

C:\secude psecrt -V -p c:\home\yourpse.pse "YourDistinguishedName"

Now you are ready to send and receive signed and optionally, encrypted (PEM) messages.

Known limitations

•	After validating a PEM message you have the option to save the resulted message or keep it “untranslated” in your disk. If you save the message, the next time you open it, you see both the translated message and the translator icon; consequently you can re-translate and save again the message. This results in a message with multiple occurrences of the same body.
	This is a bug/inefficiency of Eudora, not the EuPEM plug-in , and happens with all the translators that work in the On-display context (are executed when the message is displayed to the user).
	Qualcomm has been informed for this bug and we hope they solve it in a future release of Eudora.
	For the moment you can solve the problem if  you delete the “Run Plugin: …” line  
	
	eg. 	Run Plugin:"C:\INTERNET\EUDORA\attach\Untitled47.ems <0525.0002>"
	
	before saving the message.
	
•	PEM format should be applied in the whole message (incoming) in order to be recognized as a PEM message.
•	Nested PEM messages are not supported.

Setting the default options

1.	Open the Special->Message Plug-ins Settings menu.

2.	Double-click on the PEM icon or select the PEM icon and click Settings.

3.	In the Settings dialog :

Message TAB

In the Default Message Type section 
•	Select Digitally Signed if you want every outgoing PEM message to be digitally signed. In this case, if you enable the PEM translator when you composing a message, you will not be asked to determine the type of PEM message; it will be signed, by default.
•	Select Encrypted if you want every outgoing PEM message to be digitally signed and encrypted. In this case, if you enable the PEM translator when you composing a message, you will not be asked to determine the type of PEM message; it will be signed and encrypted, by default.
Note: Your PSE has to contain the Public Key of each recipient of an encrypted e-mail. Otherwise the recipient won’t be able to decrypt this message.
•	Enable the Binary Encoding option if you want the outgoing message to be binary encoded (this stands for both digitally signed and encypted PEM messages).
•	Select Ask Each Time if you want to be able to determine the type of the PEM message, when composing the message.

In the Certificates Included section 
•	Select Yours certificate only if you want only your (sender/originator) certificate to be included in the outgoing PEM messages.
•	Select Full FCPath if you want your whole Forward Certification Path (the certification path to the root certification authority) to be included in the outgoing PEM messages.

PSE TAB

In the Personal Security Environment (PSE) Location section		
Enter the complete name of your PSE.

In the Ask for PSE password… section 
•	Select only on the first PEM operation if you want to be asked for entering the password for your PSE, only the first time it is needed to access the PSE.
•	Select on every PEM operation if you want to be asked for entering your PSE password, every time it is needed to access the PSE, which is more secure if other people have access to your PC.
•	You have the ability to change the password of your PSE by pressing the Change password… button. In this case you will be asked to enter your current PSE password (once) and your new PSE password (twice) in order to have a successful password change.

Composing a PEM e-mail

1.	Open the Message Composition window and fill in the message as normal.

2.	Click on the Translators button in the Message Composition window and select PEM. If you have selected Ask Each Time in the Default Settings window (see Setting the default options), a dialog box is raised where 
•	Select Digitally Signed if you want the message to be digitally signed. 
•	Select Encrypted if you want the message to be digitally signed and encrypted. 
Note: If encryption is selected
�	Your PSE has to contain the Public Key of each recipient.
�	The recipient has to be a valid e-mail address and a valid SECUDE alias.
	
3.	Submit the message.

4.	If you have selected “Ask for PSE password… on every PEM operation” in the Settings dialog or if your PSE is not already opened (due to a previously executed PEM operation), a (login) dialog to enter your PSE password, is raised. You have 3 chances to give a correct password. If you cancel this login dialog the message is not sent.

5.	The PEM translator is invoked and the message is sent.

Making a certification request

1.	Open the Message Composition window and fill in the message as normal.

2.	Click on the Translators icon in the Message Composition window and select PEM. 

3.	Select Certification Request.
Note: In order to be able to make this selection, you must have selected Ask Each Time in the Default Settings window (see Setting the default options).

4.	Enter the e-mail address of a CA, e.g. ice-tel-ca@darmstadt.gmd.de

5.	Submit the message.

6.	If you have selected “Ask for PSE password… on every PEM operation” in the Settings dialog or if your PSE is not already opened (due to a previously executed PEM operation), a (login) dialog to enter your PSE password, is raised. You have 3 chances to give a correct password. If you cancel this login dialog the message is not sent.

Receiving a PEM e-mail

1.	Click check for new mail.

2.	Double-click or open a new mail.

3.	If the new message is a PEM message a PEM icon is displayed in the message body. Double-click this icon to validate and possibly decrypt the PEM message.
	
4.	If you have selected “Ask for PSE password… on every PEM operation” in the Settings dialog or if your PSE is not already opened (due to a previously executed PEM operation), a (login) dialog to enter your PSE password, is raised. You have 3 chances to give a correct password. If you cancel this login dialog the message is not sent.

5.	Depending on the validation result dialogs presenting useful information are raised and specifically:

•	If a mail is a valid PEM message, information about the signer is displayed. If the signer’s public key does not exist in your PSE, you will prompt to store it in the PSE and to enter SECUDE aliases for it.

•	If the signature could not be verified, information about the signer and the reason of failure is displayed to the user. Although the validation failed, you may intend to add the Public Key of the sender to your PSE to be able to encrypt e-mail for this recipient.

•	If the (successfully) validated PEM message is a certification reply you can accept the certification, in order to update the following PSE objects:
�	PKRoot - the Public Key of the Certification Hierarchy you are participating in (identical to the CA certificate if your CA is the Root CA)
�	FCPath - the Forward Certification Path that contains all CA certificates from your certificate up to the Root CA´s certificate.
�	Cert - your own new certificate.

Note: Once your PSE is updated, you are part of the CA Hierarchy. Your signatures can be verified by any other participant. Additionally you can encrypt messages for any participant once you add his/her Public Key to your PSE.

Features

•	Recognition of both text and multipart messages.
•	Support for X.509 v1 certificates.
•	Support for X.509 v3 certificates (NEW in this version).
•	Optional update of the user’s PSE with the public keys contained in the received PEM messages; thus, the user will be able to encrypt messages for the public key holders.
•	Maintenance of the PSE password from within Eudora.