1

My assumption is that S/MIME almost always utilizes certificates as follows:

  • My certificate can be used to allow people to encrypt messages and send them to me.

  • My certificate (the same certificate) is used by me to sign messages and send them.

Is there an RFC reference that specifies this is a requirement for S/MIME? I'm scanning through RFC5751 and not seeing anything jump out at me...

Improve this question

2 Answers 2

Reset to default
2

RFC 5751 describes the packaging of signed and enciphered data using certificates. https://www.rfc-editor.org/rfc/rfc5751

https://www.rfc-editor.org/rfc/rfc5751#page-18 This link provides information about creation of SMIME messages using the certificates; where SMIME can be sign only message or sign and encrypt message etc.

It is not necessary to have signature and encryption together, based on the implementation you can have only signatures implemented. Also some implementation might require a user to have 2 certificates where one is used for signing and one for encryption.

In normal case in which each user have one certificate and signing and encryption both are implemented, the process is as follows: The sender of the mail will sign the message with senders private key and encrypt the message with receivers public key.

Improve this answer
1

You're very close, though let me fix your assumption:

Your certificate is used to allow people to encrypt messages to you. The certificate is public information. It is shared with anyone who is interested.

Your private key enables you to sign messages and decrypt messages others have encrypted to you. (Not your certificate.) The private key is confidential and you must not share it with anyone else.

I don't know if which RFC this is stated in; this is just part of the basic architecture. Not sure that it matters where in the RFC it says it.

Improve this answer
2
  • You also sign messages with a certificate, see the RFC on SMIME: rfc5751. After doing some further research in this rfc, I discovered that you CAN use different certificates for signing and encryption. From section 2.5.3 of that RFC: The encryption key preference attribute allows the signer to unambiguously describe which of the signer's certificates has the signer's preferred encryption key. This attribute is designed to enhance behavior for interoperating with those clients that use separate keys for encryption and signing.
    – David De Groot
    Jun 6, 2012 at 13:03
  • @DavidDeGroot, You don't use a certificate to sign messages; you use a private key to sign messages. There is a correspondence between a certificate, the public key it contains, and the private key that matches that public key.
    – D.W.
    Jun 6, 2012 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .