Monday, October 28, 2013

S/MIME (Secure/multipurpose Internet Mail Extensions)


It is a standard for public key encryption and signing of MIME data. s/mime is on an IETF standards track and defined in number of documents. It was originally developed by RSA data security inc. S/MIME provides the cryptographic security services for electronic messaging applications e.g authentication, message integrity, privacy and data security.S/MIME specifies the MIME type for dta enveloping which means encryption.MIME entity to be enveloped is encrypted and packed into an object which subsequently is inserted into an application MIME entity.
Before S/MIME can be used in any of the above applications one must obtain and install an individual key/certificate either from one’s in house certificate authority or from a public CA.  Encryption requires having the destination party's certificate on store (which is typically automatic upon receiving a message from the party with a valid signing certificate).  While it is technically possible to send a message encrypted (using the destination party certificate) without having one's own certificate to digitally sign, in practice, the S/MIME clients will require you to install your own certificate before they allow encrypting to others.   

Depending on the policy of the CA, the certificate and all its contents may be posted publicly for reference and verification. This makes the name and email address available for all to see and possibly search for.

 Other CAs only post serial numbers and revocation status, which does not include any of the personal information. The latter, at a minimum, is mandatory to uphold the integrity. Even more generally, any message that an S/MIME email client stores encrypted cannot be decrypted if the applicable key pair's private key is unavailable or otherwise unusable (e.g., the certificate has been deleted or lost or the private key's password has been forgotten). Note, however, that an expired, revoked, or untrusted certificate will remain usable for cryptographic purposes. In addition, indexing of encrypted messages'clear text may not be possible with all email clients. Regardless, neither of these potential dilemmas is specific to S/MIME but rather cipher text in general and do not apply to S/MIME messages that are only signed and not encrypted.


No comments:

Post a Comment