While digital signatures can verify an author's identity and ensure content consistency, they cannot
protect the content itself.
For example, if someone intercepts a digitally signed message, he or she can still read its content.
However, the attempt to alter the content is detected because the digital signature check will fail.
If you want to protect the content of the document so that it cannot be read, you must use encryption.
Microsoft Windows operating systems support file based encryption called Encrypt and File System or
DFS.
Also, Outlook supports the encryption of email messages.
So let's talk about efforts to encrypt a file by using it first.
You must have an F first certificate issued like all the certificates.
The certificate also provides a private and public key pair.
However, this keys are not used directly to encrypt or decrypt content.
This is due to the inefficiency of an algorithms that use a symmetric encryption.
Well, the algorithms use one key for encryption and another for decryption.
These algorithms are much slower than algorithms that use the same key for both encryption and decryption,
which is called symmetric encryption.
DFS uses a hybrid approach to overcome this problem.
When a user selects the option to encrypt a file, the local computer generates a symmetric key, which
is also known as a file encryption key.
And uses the skill to encrypt the file after it encrypts the file.
The system uses the user's public key to encrypt the symmetric key element stored on the file.
Hadar runs a user who originally encrypted the file, wants to decrypt the file and access its content.
The local computer accesses the user's private key.
It first decrypt the symmetric key from the file header, which also is called the data decryption filter
do def after loop.
It uses the symmetric key to decrypt the content.
This is adequate if the files owner is the only person who works for the decrypted file.
However, there are scenarios in which you would want to share encrypted files with all the user, and
it might be inconvenient to decrypt the file before sharing it with other users.
But if other people.
Also the user who originally encrypted the file loses his or her private key.
Then the file might be inaccessible to anyone.
To resolve this data recovery filter dev d r f is defined for each file encrypted with IFRS.
When you configure IFRS for use locally or in an 80 year domain.
The Data Recovery Agent.
Rule is defined by a default and assigned to the local or domain administrator.
The DRC certificate can be used to decrypt files in case the private key of the originating user is
not accessible for some reason.
When a user encrypts the file with first, he or his or her public key is used to encrypt the symmetric
key and alert and group.
That key is then stored in the D, d, f or the file header.
At the same time, the public key of the zero certificate is used to encrypt the symmetric key once
more, and the resultant encrypted key is then stored in the D of DRM of the file header.
If there is more than one disarray defined the symmetric keys and grouped it with each of the array
public key.
Then if the user who originally encrypted the file doesn't have a private key available for any reason,
the dear array can use its private key to decrypt the symmetric key from the DRM and then decrypt the
file.
Please know that as an alternative to the DRC, you also can use the key recovery agent or KRC to retrieve
a user's private key from a CIA database.
We've talked about it in the previous lesson.
If you have enabled key archival for the EFL certificate template on this C, when a user wants to share
an encrypted file with other users, the approach is similar to using DRC.
When the user selects first sharing the files, owner must select a certificate from each user who shares
the file.
This certificate can be published to editors and are accessible from there.
When the owner of Select the certificate, the public key over the destination user encrypt the symmetric
key which is then added to the file header.
At this point.
The other users also can access the first encrypted content because they can use their private keys
to decrypt the symmetric key.
Please know that you can also define a data recovery certificate for Bitlocker Drive Encryption.
Although Bitlocker Data Recovery Agent Certificate template is not predefined in aid to the address,
you can copy the Kyari template and then add new application policies for Bitlocker encryption and data
recovery by using the following object identifiers.
Make local Bitlocker.
Drive encryption and Bitlocker Data Recovery Agent.
After you enroll a user for this certificate, you can define a recovery agent for the domain level.
If you use group policies settings in the following path computer configuration, window settings,
security, public key policies bitlocker drive encryption.
It is recommended that you use Bitlocker for full drive encryption.
Lots of worries about email encryption.
Besides using files to encrypt files and bitlocker to encrypt drives, you can also use certificates
to encrypt emails.
Email encryption, however, is more complicated than a digital signature, although you can send digitally
signed emails to anyone, you cannot do the same with them.
Encrypted email.
To be able to send an encrypted email to someone with a PGI TKI, you must possess the recipient's public
key from his or her key pair in the aid of this environment, which here this exchange server is an
email system you can publish to the public kids or world mailbox users to a global address list.
When you do that, applications such as Outlook can grab a recipient's public key easily from the girl.
And if you are ascendant, send an encrypted email.
When you send an encrypted email to an internal user, your email application takes the recipient public
key from Google.
Encrypt the mail with it and then send the mail after the receiving the mail to the recipient who uses
his or her private key from the certificate to decrypt the content of in the middle of an email.
However, sending an encrypted email to external users is more complicated.
While the public keys of internal users can publish to a do this or the girl, the the same is not true
of all external users to send an encrypted email to an external user.
The first must get his or her public key.
The external user can send it to you in a dope c r file, which you can import in your local address
book.
Also even external users are to one digitally signed email.
Then you will get his or her public key, which also can import to your local address book of two of
the public key imports to your address book.
You can use it to a certain group that emails to external user or users.
Please note that if you want to provide authenticity, content, consistency and protection, then you
can send a message that is both digitally signed and encrypted.
Next up, we'll have a demonstration.
Well, we'll see.
Well, we'll see how to encrypt a file with DFS.
I'll see that.