I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My initial thought was that it would be similar to TLS checks but some things are not apparent to me . Basically, what are the differences between TLS cert validation and S/MIME cert validations.

  1. Do we have to do revocation checking ? Wouldnt that be an overkill for mail to do it every time ? If i am caching CRL/OCSPs for each user certificates that my client finds, wouldnt that require large disk storage. A user can get a signed email from anyone, so there are potentially thousands of users with certificates.

  2. What key extensions need to be checked that are specific to s/mime certs and validation ?

  3. This is in Java and I saw there is a method checkClientTrusted which does chain validation. But it seems that it is not complete. What are the checks that this api does specifically ?


1 Answer 1

  1. Yes, you have to to revocation checking when validating a S/MIME signature. What is different from TLS ist the time aspect. A TLS certificate needs to be valid exactly at the time of validation, while a S/MIME certificate must have been valid at the time the e-mail was created. It doesn't matter if it has been revoked afterwards. This means, that you need to use a CRL for verification, because OCSP responses do not include a revocation time.
  2. The proper key usage must be checked. The certificate mus contain the keyUsage digitalSignature and/or the extendedKeyUsage emailProtection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .