Questions tagged [smime]
S/MIME is a protocol for encrypting and signing messages, e.g. emails.
99
questions
0
votes
0
answers
137
views
Guidance: S/MIME Signed Certificate invalid for many clients even though it worked previously and still works
I have a very strange problem and i would like to get some guidance on this.
Problem description:
My application is sending S/MIME signed Email messages to clients. It worked perfectly no problems ...
- 111
2
votes
1
answer
97
views
Any client still supporting the S/MIME Capabilities Extension in 2023?
RFC 4262, "X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities", defines the S/MIME Capabilities Extension which allows to communicate through ...
- 2,788
0
votes
1
answer
130
views
What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts
What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts?
Use case, both of parties use third party ...
- 17
1
vote
1
answer
183
views
Incomplete decryption of S/MIME mails using openssl cms
We're receiving signed and encrypted mails from many senders. For most senders, the decryption with openssl works fine using the following command:
openssl cms -decrypt -recip <path-to-key> -in &...
- 111
0
votes
1
answer
512
views
Does S/MIME encryption encrypt with each recipient's key?
If I send an email through S/MIME protocol to a group of recipients, does the email client require to encrypt the same email content with each recipient's public key before sending to each recipient? ...
0
votes
1
answer
107
views
GnuPG: gpa.exe hangs when I click on "smartcards" AND scdaemon cannot recognise SC-HSM 4K
https://dev.gnupg.org/T6097
I am trying to get GnuPG to work with my SmartCard-HSM 4K on Windows, using the GP4Win bundle.
Kleopatra doesn't recognise the SC-HSM 4K at all, even though, it does ...
- 465
0
votes
0
answers
897
views
openssl smime sign and encrypt loads
I am trying to investigate openssl S/MIME in order to both sign and encrypt loads to be transfered over an untrusted network.
Loads need to be protected in authenticity and confidentiality.
I have ...
- 193
1
vote
0
answers
286
views
iOS (iPhone) S/MIME certificate with multiple addresses
On an iPhone I have a mail account in the native Mail app with two distinct e-mail addresses, and a certificate that lists both of those e-mail addresses in the SAN field. When I try to send mail with ...
- 11
0
votes
1
answer
191
views
How many keys do you use for signing and encrypting emails? [closed]
Situation
I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
user242984
1
vote
2
answers
2k
views
Create CSR for S/MIME certificate from existing OpenPGP key pair
While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone).
I believe the ...
- 113
2
votes
1
answer
825
views
Is there any point in using PGP or S/MIME when your receipients mostly don't use it?
For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
- 244
1
vote
1
answer
333
views
What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?
I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email.
It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
- 11
5
votes
0
answers
2k
views
Manually verifying signature in S/MIME mail with openssl
I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...
- 151
2
votes
1
answer
419
views
Force specific encryption cipher for S/MIME mails
I have a number of contacts who can only decrypt 3DES, when it comes to S/MIME encrypted mails. I'm aware that this is by far not ideal, but better than no encryption at all.
My problem is, that I ...
- 159
7
votes
3
answers
737
views
Why do I need an own certificate to encrypt a S/MIME message?
I try to use Thunderbird to encrypt a message. I do not want to sign the message. Encryption is done with the public key of the receiver. I have imported the certificate of the receiver. But when I ...
- 482
0
votes
0
answers
74
views
Does SMIME 4, or any prior version, support multiple private keys for a single individual?
I am investigating S/MIME and if it's possible to have a device-specific signing key (or if that's a good idea).
The intention is to reduce risk by making the private key read only on the device(es) ...
- 131
2
votes
1
answer
4k
views
Why do we need DKIM to be used along with S/Mime?
S/Mime can be used to encrypt email and it can also be used by the sender to provide his digital signature so that the recipient is able to confirm the authenticity of the sender.
Why then do we ...
- 23
1
vote
0
answers
948
views
Is it possible to decrypt Outlook Web App S/MIME messages in a web browser with same webclient? [closed]
Normally, you would use a mail client for mail encryption. Though, I can access smartcard security functions from the browser for a secure login.
Therefore, is it possible to decrypt Outlook Web App ...
- 127
4
votes
3
answers
1k
views
What's the point of S/MIME?
I received an email recently which displayed as an empty body with a smime.p7m attachment. After some Googling, I discovered it was an encrypted email -- neat! So I started looking for the key. But... ...
anon
1
vote
0
answers
221
views
Get S/MIME from Digicert, store in escrow on on-prem CA
I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance.
Unfortunately I can't let users self-...
- 173
1
vote
1
answer
791
views
What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?
Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation.
My .inf file looks like this:
[Version]
Signature="$...
- 173
1
vote
0
answers
612
views
Digital Signature is not valid
I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
- 21
1
vote
0
answers
566
views
Replying to a digitally signed email using thunderbird
So Basically I sent a digitally signed email using a certificate issued by Sectigo RSA Client Authentication and Secure Email CA.
Now the recipient of the email replied to me with a certificate ...
- 21
3
votes
2
answers
215
views
Encrypted email from outlook to other
I have recently setup S/MIME in Outlook for my company's employees to send encrypted and digitally signed emails to one another. Is it possible to send encrypted emails to other email platforms from ...
4
votes
2
answers
1k
views
smime - is encrypting reply to a signed mail without own cerificate possible?
From what I understood, was that having a S/MIME certificate allow me to sign emails, and any recipient of my signed email would be able to encrypt emails send to me.
Is that correct? or does the ...
- 43
1
vote
2
answers
408
views
unable to verify AWS EC2 Instance Identity Document with libressl
I'm trying to follow the steps here:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
to verify an instance identity document, and I'm getting success when I ...
- 165
2
votes
1
answer
126
views
Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name
I was reading Defective Sign & Encrypt in S/MIME,
PKCS#7, MOSS, PEM, PGP, and XML
and in section 5.1 Naming Repairs
By signing Bob's name into her message, Alice explicitly identifies
him ...
- 2,493
1
vote
1
answer
464
views
Automatically import/deploy/distribute private key to users for use with S/MIME
it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
- 11
1
vote
0
answers
361
views
What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]
I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge.
Another solution I found is ...
- 35
51
votes
5
answers
6k
views
What actions should I, as an end user, take in response to EFAIL?
There's a lot of talk about EFAIL:
The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...
- 65.4k
5
votes
1
answer
3k
views
S/MIME signing and verification - how do I find proper certificate?
I'm trying to debug a S/MIME signing framework that is functioning wrong. On the input I have
a signed message with detached certificate
a certificate which private key the message was probably ...
- 153
1
vote
1
answer
1k
views
Use of S/MIME capabilities attribute
If you examine an S/MIME-signed file with
$ openssl cms -in file.sgn -noout -cmsout -print
you see that S/MIME capabilities are also included in the signature:
...
object: S/MIME Capabilities (1.2....
- 647
2
votes
0
answers
300
views
Certificate Transparency and S/MIME certificates
When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies.
Is CT designed to log S/MIME ...
- 469
6
votes
2
answers
10k
views
Verify S/MIME signature with no certificate included
Let's sign a file with
$ openssl smime -sign -in file -out file.sign -outform DER -inkey private.pem -signer certificate.pem -nocerts
With the option -no certs no certificate is included in file....
- 647
1
vote
1
answer
424
views
What exactly is digested in an S/MIME signated-only e-mail?
What exactly is digested in an S/MIME signated-only e-mail?
It's definitely not only a sha256-digest of the original message, which means that
$ openssl dgst -sha256 <<< "Text"
...
- 647
1
vote
1
answer
129
views
Signing but not encrypting trivial generic e-mails
Let's assume my professor sends a signed but unencrypted (S/MIME) e-mail to us students like this:
Dear students,
there will be no class tomorrow. I'm sick.
Regards Professor
Now I ...
- 647
1
vote
2
answers
572
views
Can I re-sign SMIME certificates with my own CA?
Many large corporations choose to use their own CA to sign their employee's SMIME certificates. Which is fine for internal use, but they typically expect external users to import their corporate CA ...
- 1,253
0
votes
1
answer
312
views
Is gnupg's tsign compatible with S/MIME
GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy ...
- 103
0
votes
0
answers
3k
views
Using a PowerShell Self-Signed Certificate for Outlook S/MIME
I'm testing out a way that myself and a few others could use S/MIME for our email traffic. I'm using Outlook 2016 with Win10. I have generated my test certificate with the following command in ...
- 153
0
votes
1
answer
545
views
Disable 3DES (Triple DES) in thunderbird
Thunderbird still uses 3DES for SMIME encryption (bug #1167857).
Since 3DES is severely "broken" and uses only 80 bits of security, I would like to tell my Thunderbird, not to use that algorythm any ...
- 2,390
4
votes
1
answer
8k
views
Receiving S/MIME signed emails with Gmail
When I receive an email signed (not encrypted) with S/MIME in my Gmail account, it provides me no option of verifying the signature when I'm using the webmail interface. Which is fine, I have made ...
- 41
0
votes
0
answers
98
views
hashing algorithm mail signing
What determines the hashing algorithm used form mail signing? I sign an mail. it is first run through a hashing algorithm and next encrypted with my private key. Bob, the receiver will decrypt it with ...
- 1,558
1
vote
1
answer
88
views
Is my SMIME certificate secure?
Lets take a random well-known Root CA. This CA allows me to sign my own certificate so that it is immediately trusted by others since they trust the root CA. The only thing, which the CA ever sees is ...
- 113
5
votes
2
answers
2k
views
EU standardized digital signature for form-data
Problem
I am trying to identify if there are any standards (accepted by the EU) regarding client-side digitally signing the form-data before it is submitted.
So the constraints are:
know standard
...
- 151
2
votes
2
answers
10k
views
Incoming email with smime.p7s attachment
This is a scenario I have at work.
We're receiving emails with .p7s attached files from a single user of a company(hence the company domain for eg. abc.com) our users interact with via mail. We use ...
- 190
0
votes
0
answers
96
views
What public key systems allow for delegation?
I am looking for a public key system that allows for a 3rd party to use that key for other purposes.
What private key systems allow for this? PGP, S/MIME, PKI?
- 50.7k
0
votes
1
answer
610
views
s/mime edit an existing certificate
We are using an encryption appliance that is capable of creating S/MIME certificates for internal users. The appliance is synchronizing with AD to get the user. When the certificate is created it will ...
- 1,558
9
votes
2
answers
1k
views
Why don't banks sign their email using S/MIME?
If email sent by my bank included S/MIME signatures that my mail client can verify, then I would have the assurance that the mail was not tampered with or sent by some malicious third-party. Most ...
- 193
3
votes
1
answer
2k
views
Yubikey with S/MIME certificate
I would like to do the following. Can anyone tell me if this is possible?
Store the private key for an S/MIME certificate from Digicert on a Yubikey.
Backup the private key to another location.
Use ...
- 31
4
votes
1
answer
310
views
Certificate and Path validation for S/MIME
I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
- 315