I try to use Thunderbird to encrypt a message. I do not want to sign the message. Encryption is done with the public key of the receiver. I have imported the certificate of the receiver. But when I try to send the message Thunderbird insists on my certificate. Why?
When a sender uses Thunderbird to send an S/MIME encrypted message to a recipient, Thunderbird requires the sender's certificate in addition to the recipient's certificate, so that Thunderbird can send the sender's certificate along with the message to the recipient. This is done for two reasons:
1) So that the recipient can verify the sender's digital signature on the message, which is made using the sender's private key that corresponds with the sender's public key in the sender's certificate.
2) So that the recipient can reply with an encrypted message back to the sender.
Thunderbird (as well as any other email client) needs your own certificate to encrypt the email for yourself, too.
Why is that so?
When you send an email, the email is not just sent, but a copy of it is kept in your sent folder. As a consequence, when you send an encrypted email, the email needs to be encrypted not only for the recipient, but also for yourself. Otherwise, you would not be able to read your own copy of the sent email. This means that the message is encrypted using both, the recipient's as well as the sender's public key, so both can decrypt it using their private keys. (The same mechanism is used when you send to multiple recipients, btw.)
The above is specified in RFC 8551 S/MIME 4.0 Message Specification (as well as its predecessors). Cited from section 3.3 Creating an Enveloped-Only Message, step 2:
In addition to encrypting a copy of the content-encryption key (CEK) for each recipient, a copy of the CEK SHOULD be encrypted for the originator and included in the EnvelopedData.
Note that the content-encryption key (CEK) refers to the actual mechanism which is to encrypt the message contents using an ad-hoc generated symmetric key (the CEK). Then this key is encrypted asymmetrically using the public key. So when, for the sake of simplicity, we say that a message is encrypted with a public key, this actually means that only the CEK is encrypted with the public key and attached to the message. A detailed specification can be found in RFC 5652 Cryptographic Message Syntax (CMS).
In theory, the email client could just encrypt for the recipient and leave the sent copy unencrypted, but that would create a security hole that the user would most probably not be aware of, which is totally undesirable.
Generally, a Good IdeaTM
According to the S/MIME Version 4 standard, there is no technical reason why any email client needs to have a certificate or to sign or to have reversible encryption of the messages, too.
But for any general usability, it is standard that all email clients require a sender certificate for:
- signing for sender verification: it is usually not enough for an ecosystem of encrypted messages that one cannot also confirm senders, although technically, this is not required
- encrypting responses: if the recipient wants to respond, the sent email will include the quoted first message, which would be sent unencrypted if the sender did not also send a certificate to send an encrypted message back
So, while it is possible to have a use case where you want to send encrypted emails but where you do not need to verify or reply to senders, it is certainly not the common use case that user-focused email clients are set up for and would, in fact, be reasonable to prevent users from attempting in order to maintain the integrity of the encrypted email ecosystem.
If you need to satisfy this use case, it is moderately easy to craft one's own email-sending script to do this, as you demonstrated.
Outlined in the S/MIME Specification
S/MIME 4 spec says that client
SHOULD also have a certificate so that the sender's public key can be able to access the key used to encrypt the message, which would mean that clients, like Thunderbird, would be expected to follow that.
There is also a version of the Cryptographic Message Syntax CMS spec where the key used to encrypt the message is derived from both the recipient's and sender's keys, which would mean that the sender would need a certificate in order to encrypt the message at all. I do not know at this time if Thunderbird creates its message keys using this method.