Working with S/MIME with MS outlook
S/MIME (Secure/Multipurpose
Internet Mail Extensions) is a standard for public key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents,
most importantly RFCs 3369, 3370, 3850 and 3851. S/MIME was originally
developed by RSA Data Security Inc. The original specification used
the IETF MIME specification with the de facto industry standard PKCS#7 secure message format. Change control
to S/MIME has since been vested in the IETF and the specification is now
layered on Cryptographic
Message Syntax, an IETF specification that is
identical in most respects with PKCS #7. S/MIME functionality is built into the
majority of modern email software and interoperates between them.
Before S/MIME can be
used in any of the above applications, one must obtain and install an
individual key/certificate either from one's in-house certificate authority (CA) or from a public CA. The accepted best practice is to use separate private keys (and
associated certificates) for signature and for encryption, as this permits escrow of the encryption key without
compromise to the non-repudiation property of the signature key.
Encryption requires having the destination party's certificate on store (which
is typically automatic upon receiving a message from the party with a valid
signing certificate). While it is technically possible to send a message
encrypted (using the destination party certificate) without having one's own
certificate to digitally sign, in practice, the S/MIME clients will require you
to install your own certificate before they allow encrypting to others.
Depending
on the policy of the CA, the certificate and all its contents may be posted
publicly for reference and verification. This makes the name and email address
available for all to see and possibly search for. Other CAs only post serial
numbers and revocation status, which does not include any of the personal
information. The latter, at a minimum, is mandatory to uphold the integrity of
the public key infrastructure
Comments
Post a Comment