2

RFC 4262, "X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities", defines the S/MIME Capabilities Extension which allows to communicate through the X.509 certificate the encryption algorithms supported by an S/MIME recipient whose cryptographic capabilities are still unknown:

Through the extension mechanism defined in this specification, the certificate may also identify the subject’s cryptographic S/MIME capabilities. This may then be used as an optional information resource to select appropriate encryption settings for the communication.

In Windows this extension looks like this:

X.509 certificate with S/MIME Capabilities Extension

Now, according to an extensive web search I made, I can see that this extension was supported in old MS Outlook versions but I cannot find any clear reference for any current support for this extension in any email client. I've even looked into the source code for Mozilla Thunderbird as well, but didn't find any usage for this extension.

Do you know of any current software supporting it?

2
  • 1
    Do you have a reason to believe it's not supported, at least in Outlook? Or are you simply looking for an affirmative claim that it is currently supported? I'd be surprised if Outlook stopped supporting such a field, since Microsoft takes S/MIME support moderately seriously and it's a useful property to be able to communicate in a certificate.
    – CBHacking
    Jul 22, 2023 at 22:22
  • @CBHacking, as you say I'm looking for an affirmative claim that confirms it is still supported. I know I could possibly confirm it myself by generating certificates with different values for this extension and observing how MS Outlook behaves but I haven't done that yet. Jul 24, 2023 at 17:01

1 Answer 1

1

I did some research with regard to S/MIME capabilities about two years ago, and I've found that it's not widely supported any more, if at all.

Capabilities are defined by the MUA's (mail user agent's) support, not by the certificate issuer or owner, so the client's should include capabilities with the certificate (for example, as part of S/MIME signed message). However, I've found that neither MS Outlook nor Apple Mail on macOS or iOS include capabilities, and I doubt that other MUAs do.

I believe that the reasons for this are that for one, the S/MIME specs define that adding capabilities and deciding from the receipient's capabilities list are both optional (SHOULD). The second reason is that, at the time when capabilities were invented, they made much more sense, because most user's would have one personal computer with one MUA, which would then have a defined set of capabilities. Nowadays, however, it is common to use multiple devices with email, using different clients, which may well support different capabilities. Therefore, S/MIME capabilities appear more or less negligible. The implementation is relatively complex, because the capabilities need to be cached, and emails with multiple recipients that have non-compatible capabilities would require additional processing. So my guess is that most, if not all software manufacturers of MUAs decided that it's not worth the effort.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .