Front cover - IBM Redbooks

Important considerations with Notes IDs
It is important to take good care of Notes IDs. Thus, there are two particular
things that are worth remembering:
1. If a user is no longer able to use his or her Notes user ID file – either because
that person forgot the password needed to decrypt the Notes user ID, or
because the file has been physically lost – any mail encrypted using that
person’s private key is permanently lost (assuming that no recovery of said ID
is possible, as previously discussed).
2. It is important to treat the Notes user ID carefully, since the private key is
contained within the Notes user ID file. If the Notes user ID is compromised,
anyone that has a copy of that Notes user ID can impersonate that user
(assuming that none of the mechanisms for mitigating that circumstance are
used).
Electronic mail message encryption
One way Lotus Notes offers confidentiality is by providing services by which
electronic mail can be easily and efficiently encrypted. The manner in which this
is performed by the Lotus Notes client is illustrated in Figure 6-16.
Figure 6-16 Electronic mail message encryption in Lotus Notes
This is a practical application of the hybrid solution that we covered in the
security fundamentals chapter. The numbered steps in the diagram are
described as follows:
1. Alice decides to send an encrypted Notes e-mail to Bob. The Notes client,
seeing that the “Encrypt” checkbox is set, generates a random encryption key
(the secret key, which is generally referred to as being a session key, since a
Chapter 6. Public key infrastructures 227