Enigma

Enigma automatically protects your Internet e-mail from forgery and interception. It encrypts and signs outgoing mail and decrypts and checks incoming mail. It contains built-in PGP-compatible code. It works with Windows, Mac OS, most UNIXes, and many other platforms. It will work with Eudora, Netscape Mail, Internet Explorer Mail, and many other mailers.

• Features
• How it works
• Download Enigma
• Security issues
• Known bugs
• Future improvements
• Licensing
• E-mail the author
• What errors mean

Features

• Written in Java for maximum portability
• Uses built-in PGP-compatible code for maximum security
• Works with any mail program that uses the POP3 and SMTP protocols
• Searches any number of local keyrings and a user-specified keyserver

How it works

Enigma impersonates a POP3 and SMTP server to your mail client, and a mail client to your mail servers. When your mail program retrieves your mail through Enigma, messages are checked for PGP sections. If found, they will be decrypted and/or authenticated before being passed on to your mail program. When you send a message, Enigma signs and encrypts it if a public key is available for the recipient.

All a user has to do is supply their passphrase when the program starts. From then on, it works entirely automatically.

Download Enigma

You can now download the first full version of Enigma, in a new easy-to-install format.

This file contains the Enigma source and binaries (enigma.zip) and a signature of them (enigma.zip.sig), an example preferences file (enigma.ini) and configuration instructions (config.html).

Unzip these files into a folder, but don't then unzip enigma.zip unless you want to read the source code.

You need version 1.1.x of the Java Developer's Kit or the Java Runtime Environment to be installed.

Finally, you need to tell your mail program about Enigma. Find the settings for POP and SMTP server, and change them to the name of your own machine.

To run the program, just type

java -classpath path\enigma.zip;%CLASSPATH% enigma.Startup yourinitialisationfile

with the full path given to your intialisation file, enigma.ini. Don't worry if you get warnings that certain libraries are missing - this is only because Cryptix's native code plug-ins aren't finished yet. Enigma works fine without them, but will receive a speed boost once they are done.

If you have having problems, trying changing the Verbosity section in your intialisation file to 1 (verbose) and see what information is given. E-mail me if you still can't fix it.

When you get Enigma working, I'd love to hear from you. Put my key in your keyring and send me an encrypted message through Enigma. Also tell me if you would like to be put on my enigma-news mailing list.

Keyfetching security issues

By default, Enigma's automatic key-fetching facility is not used - mostly for speed reasons, as communicating with a keyserver every time you communicate with a recipient to check for a public key can be slow if you are (in Internet terms) some distance away. If you use the facility, be aware that fetched keys are not trusted. No secure path exists between Enigma and the keyserver; even if it did, this would provide little protection as keys can be submitted to servers by anybody. The next version of Enigma will certainly only use keys that are self-signed, and will most likely also check signatures. A user-configurable level at which keys will be accepted (similar to PGP's summing of the trust levels on signators' keys) will allow you to decide how certain you want to be of keys' authenticity.

The best way to use the key fetching facility is by getting and verifying public keys of your regular correspondents using the same methods as PGP, adding them to your public keyring. Enigma will always use a local key in preference to a remotely-fetched one. Leave the automatic fetching as a convenience feature for communicating with strangers.

Trust

Obviously, you should be very careful with any program that gets access to your passphrase, secret key and mail servers. The full source code, signed by me, is available for anyone to check. But I wrote Enigma to protect people's privacy, not introduce a trojan horse for certain three-letter agencies.

Known bugs

Future improvements

All sorts of things are planned for the next version of Enigma. Here's a few of my current ideas. Please e-mail me if there's something you would find useful and like added.

• More integrated support for MIME and maybe support for PGP/MIME
• PGP5 - 3DES, CAST and Diffie-Hellman support, new packet format support
• Protocols - News and IMAP4 handlers
• Further ahead - support for Carl Ellison and friends' Simple Public Key Infrastructure, which includes Ron Rivest et al.'s proposed Simple Distributed Security Infrastructure

If you would like to help code any of these features, get in touch - I'll be happy to provide as much help as is necessary.

Further code is also being written fast. Here are some of the features that have already been written and will be included in the next release.

• Timing-out, multiple passphrases
• Automatic configuration
• System-wide policy files

Licensing

Enigma is being distributed as freeware. I assert my moral rights and copyright with regard to the software and documentation, but the whole point of the program is to increase the use of strong cryptography on the Internet. Therefore - give it to your friends! Tell everyone! The software is provided "as is". The documentation is provided purposely as a template which can be modified for organisational use. If there is something which would help you use - or install for others to use - Enigma, I'll be happy to help provide it. I am particularly happy to help system administrators!

Cryptix, the cryptographic library underlying Enigma, contains a similar license. It is Copyright © 1995, 1996, 1997 Systemics Ltd on behalf of the Cryptix Development Team. All rights reserved.

Please feel free to send comments, code, bug reports ;-) etc. to ianb@acm.org. You can get my PGP public key here.

Last modified 30 July 1998