Managing the public keys and certifications of S/MIME protocol

Question

I don’t have any experience in the security field, and I want your help. I want to ensure if the following suggestion is applicable and secure, if it’s not, please give me your suggestion to solve the problem.

A company wants to build a website to manage and monitor their employees, now each employee has a unique nick name, however, the official wants to use S/MIME protocol in order to allow the employees to transfer sensitive messages between each other. Those employees have a big problem in managing the public keys and certifications, can I use Keybase.io (its open source) and improved it to upload the employees’ certifications and public keys?

Do you think that it will be secure, where when john wants to send a message to Sara, he will put her nick name and the system will request her public key from the server and validate her certificate, is this way secure, if it’s not how I can improve it?

Answer 1

keybase.io simply allows for users of social media sites to access each others public key (if one exists for the targeted social media site).

It is not unlike GPG's 'keyserver' functionality for providing users a way to get to my public key.

The question(s) you are posing boils down to a PKI (public key infrastructure).

There are many solutions available as turn key options; however the tone and question direction indicates a possible need for a custom one-off solution (while I don't necessarily recommend it, not because you can't but because it is and can be a legal nightmare) you should do your due diligence.

First brush up on implementation for the high level functionality. Next research the nitty gritty details provided by experts in the field.

1. NIST PKI - A high level overview
2. NIST PKI Technical Specifications - Details on management of a PKI; design, implementation, configuration, recovery etc.
3. NIST 800-32 - The details of a PKI implementation; ciphers, key sizes, algorithms, physical, virtual security, escrow, data recovery, emergency plans for key compromise etc.

One thing about using an existing solution is the majority of the heavy lifting is already in place. However the majority of the PKI structures of old using a centralized method of PKI management has given way to the distributed methods that GPG employs which utilizes a 'circle of trust' vs. the traditional escrow type management solutions.

Answer 2

I'm going to focus on what I think is the core of your question:

A company wants to build a website to manage and monitor their employees

There are two parts here: managing (allowing users to find each other's public keys, and presumably you also want the ability to control who is part of this network) and monitoring (allowing the company to decrypt any protected data, for example after someone quits).

As @jas- said, you certainly need some sort of Public Key Infrastructure (PKI) to do this. I differ from @jas- in that I don't think a distributed "circle-of-trust" like PGP is the answer because a company is, by nature, a centralized authority; if Janice from accounting decides that her dog should be added to your corporate email network, there's nothing you can do to stop it in the PGP model.

The normal way this is handled is to buy commercial PKI software that sets up a private root CA for your company and plugs into your corporate email system (like Microsoft Exchange) to provide public-key lookup and private decryption key backup (aka escrow) for all users. PKI companies that offer this will also provide an Outlook plugin which adds Sign and Encrypt buttons to your users' Compose window.