Certificate and Path validation for S/MIME

Question

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My initial thought was that it would be similar to TLS checks but some things are not apparent to me . Basically, what are the differences between TLS cert validation and S/MIME cert validations.

1. Do we have to do revocation checking ? Wouldnt that be an overkill for mail to do it every time ? If i am caching CRL/OCSPs for each user certificates that my client finds, wouldnt that require large disk storage. A user can get a signed email from anyone, so there are potentially thousands of users with certificates.

2. What key extensions need to be checked that are specific to s/mime certs and validation ?

3. This is in Java and I saw there is a method checkClientTrusted which does chain validation. But it seems that it is not complete. What are the checks that this api does specifically ?

Answer 1

1. Yes, you have to to revocation checking when validating a S/MIME signature. What is different from TLS ist the time aspect. A TLS certificate needs to be valid exactly at the time of validation, while a S/MIME certificate must have been valid at the time the e-mail was created. It doesn't matter if it has been revoked afterwards. This means, that you need to use a CRL for verification, because OCSP responses do not include a revocation time.
2. The proper key usage must be checked. The certificate mus contain the keyUsage digitalSignature and/or the extendedKeyUsage emailProtection.