Questions tagged [smime]

S/MIME is a protocol for encrypting and signing messages, e.g. emails.

Filter by
Sorted by
Tagged with
0
votes
1answer
97 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
1answer
482 views

Use of S/MIME capabilities attribute

If you examine an S/MIME-signed file with $ openssl cms -in file.sgn -noout -cmsout -print you see that S/MIME capabilities are also included in the signature: ... object: S/MIME Capabilities (1.2....
0
votes
0answers
37 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
106 views

Force specific encryption cipher for S/MIME mails

I have a number of contacts who can only decrypt 3DES, when it comes to S/MIME encrypted mails. I'm aware that this is by far not ideal, but better than no encryption at all. My problem is, that I ...
3
votes
0answers
102 views

Manually verifying signature in S/MIME mail with openssl

I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...
0
votes
0answers
37 views

How to efficiently deploy SMIME email certificates for entire domain with Google GSuite?

Google Suite Enterprise supports centralized SMIME email signatures. This allows for easy deployment across all devices. But besides an API, there's apparently no central management. And I couldn't ...
1
vote
1answer
4k views

Can I use any ssl certificate to sign and encrypt AS2 message?

I'm absolutely new to this topic of ssl certificates, so please be patient with me. My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
4
votes
1answer
203 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
3
votes
2answers
87 views

Encrypted email from outlook to other

I have recently setup S/MIME in Outlook for my company's employees to send encrypted and digitally signed emails to one another. Is it possible to send encrypted emails to other email platforms from ...
0
votes
0answers
45 views

Email signature with PKCS11?

While S/MIME has been a PKCS7 standard, what happens while I sign/encrypt an email using a smart card implementing PKCS11? Is PKCS7 supported as kind of backward compatibility?
7
votes
3answers
244 views

Why do I need an own certificate to encrypt a S/MIME message?

I try to use Thunderbird to encrypt a message. I do not want to sign the message. Encryption is done with the public key of the receiver. I have imported the certificate of the receiver. But when I ...
7
votes
2answers
772 views

Apart from the lack of native Outlook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
0
votes
0answers
26 views

Does SMIME 4, or any prior version, support multiple private keys for a single individual?

I am investigating S/MIME and if it's possible to have a device-specific signing key (or if that's a good idea). The intention is to reduce risk by making the private key read only on the device(es) ...
1
vote
1answer
723 views

Why do we need DKIM to be used along with S/Mime?

S/Mime can be used to encrypt email and it can also be used by the sender to provide his digital signature so that the recipient is able to confirm the authenticity of the sender. Why then do we ...
1
vote
0answers
487 views

Is it possible to decrypt Outlook Web App S/MIME messages in a web browser with same webclient? [closed]

Normally, you would use a mail client for mail encryption. Though, I can access smartcard security functions from the browser for a secure login. Therefore, is it possible to decrypt Outlook Web App ...
1
vote
1answer
151 views

Automatically import/deploy/distribute private key to users for use with S/MIME

it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
3
votes
3answers
472 views

What's the point of S/MIME?

I received an email recently which displayed as an empty body with a smime.p7m attachment. After some Googling, I discovered it was an encrypted email -- neat! So I started looking for the key. But... ...
3
votes
2answers
5k views

Verify S/MIME signature with no certificate included

Let's sign a file with $ openssl smime -sign -in file -out file.sign -outform DER -inkey private.pem -signer certificate.pem -nocerts With the option -no certs no certificate is included in file....
1
vote
1answer
182 views

What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?

Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation. My .inf file looks like this: [Version] Signature="$...
3
votes
1answer
6k views

Receiving S/MIME signed emails with Gmail

When I receive an email signed (not encrypted) with S/MIME in my Gmail account, it provides me no option of verifying the signature when I'm using the webmail interface. Which is fine, I have made ...
1
vote
0answers
124 views

Get S/MIME from Digicert, store in escrow on on-prem CA

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance. Unfortunately I can't let users self-...
1
vote
0answers
384 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
1
vote
0answers
302 views

Replying to a digitally signed email using thunderbird

So Basically I sent a digitally signed email using a certificate issued by Sectigo RSA Client Authentication and Secure Email CA. Now the recipient of the email replied to me with a certificate ...
3
votes
2answers
379 views

smime - is encrypting reply to a signed mail without own cerificate possible?

From what I understood, was that having a S/MIME certificate allow me to sign emails, and any recipient of my signed email would be able to encrypt emails send to me. Is that correct? or does the ...
4
votes
2answers
12k views

Decrypting .P7M File with Key (.pem) using OpenSSL

My knownledge about security is limited so I need some help here. The Question I want to Decrypt a .P7M file using its private key (.pem). I would prefer to use OpenSSL for this. Tried so far ...
0
votes
1answer
208 views

unable to verify AWS EC2 Instance Identity Document with libressl

I'm trying to follow the steps here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html to verify an instance identity document, and I'm getting success when I ...
1
vote
1answer
70 views

Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML and in section 5.1  Naming Repairs By signing Bob's name into her message, Alice explicitly identifies him ...
1
vote
0answers
180 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
0
votes
0answers
1k views

Using a PowerShell Self-Signed Certificate for Outlook S/MIME

I'm testing out a way that myself and a few others could use S/MIME for our email traffic. I'm using Outlook 2016 with Win10. I have generated my test certificate with the following command in ...
51
votes
5answers
6k views

What actions should I, as an end user, take in response to EFAIL?

There's a lot of talk about EFAIL: The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...
4
votes
1answer
2k views

S/MIME signing and verification - how do I find proper certificate?

I'm trying to debug a S/MIME signing framework that is functioning wrong. On the input I have a signed message with detached certificate a certificate which private key the message was probably ...
0
votes
3answers
664 views

SHA1 - S/MIME and CRL validity after deprecation?

In an internal PKI using SHA1 for hashing, will S/MIME signature and CRL/ARL signature be considered invalid in the next few years (SHA1 Deprecation) ? End certificates can be revoked, CA ...
2
votes
0answers
141 views

Certificate Transparency and S/MIME certificates

When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies. Is CT designed to log S/MIME ...
1
vote
1answer
193 views

What exactly is digested in an S/MIME signated-only e-mail?

What exactly is digested in an S/MIME signated-only e-mail? It's definitely not only a sha256-digest of the original message, which means that $ openssl dgst -sha256 <<< "Text" would ...
1
vote
1answer
81 views

Signing but not encrypting trivial generic e-mails

Let's assume my professor sends a signed but unencrypted (S/MIME) e-mail to us students like this: Dear students, there will be no class tomorrow. I'm sick. Regards Professor Now I ...
2
votes
1answer
2k views

Yubikey with S/MIME certificate

I would like to do the following. Can anyone tell me if this is possible? Store the private key for an S/MIME certificate from Digicert on a Yubikey. Backup the private key to another location. Use ...
1
vote
2answers
341 views

Can I re-sign SMIME certificates with my own CA?

Many large corporations choose to use their own CA to sign their employee's SMIME certificates. Which is fine for internal use, but they typically expect external users to import their corporate CA ...
27
votes
4answers
2k views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
2
votes
4answers
259 views

Is PGP or S/MIME useful when both servers are self-controlled?

With regards to encryption and preventing a 3rd party from viewing my emails (and ignoring validity/signing), is encrypting an email via PGP or S/MIME useful when I control my server and my recipient ...
0
votes
1answer
208 views

Is gnupg's tsign compatible with S/MIME

GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy ...
8
votes
1answer
192 views

S/MIME certificates and “information leakage”

I'm considering getting an S/MIME certificate that verifies my name and email address. I've been trying to ascertain what information "leaks" if I do. The Wikipedia page on S/MIME says: Depending ...
0
votes
1answer
409 views

Disable 3DES (Triple DES) in thunderbird

Thunderbird still uses 3DES for SMIME encryption (bug #1167857). Since 3DES is severely "broken" and uses only 80 bits of security, I would like to tell my Thunderbird, not to use that algorythm any ...
0
votes
0answers
41 views

hashing algorithm mail signing

What determines the hashing algorithm used form mail signing? I sign an mail. it is first run through a hashing algorithm and next encrypted with my private key. Bob, the receiver will decrypt it with ...
5
votes
2answers
2k views

EU standardized digital signature for form-data

Problem I am trying to identify if there are any standards (accepted by the EU) regarding client-side digitally signing the form-data before it is submitted. So the constraints are: know standard ...
1
vote
1answer
42 views

Is my SMIME certificate secure?

Lets take a random well-known Root CA. This CA allows me to sign my own certificate so that it is immediately trusted by others since they trust the root CA. The only thing, which the CA ever sees is ...
7
votes
1answer
4k views

What are the security differences between SMIME email and PGP email? [closed]

Outside of key distribution, and specific to the technical details relating to encrypted email data (message body), what's the difference between SMIME and PGP? Example comparisons Security ...
0
votes
1answer
268 views

s/mime edit an existing certificate

We are using an encryption appliance that is capable of creating S/MIME certificates for internal users. The appliance is synchronizing with AD to get the user. When the certificate is created it will ...
0
votes
1answer
7k views

Incoming email with smime.p7s attachment

This is a scenario I have at work. We're receiving emails with .p7s attached files from a single user of a company(hence the company domain for eg. abc.com) our users interact with via mail. We use ...
0
votes
0answers
54 views

What public key systems allow for delegation?

I am looking for a public key system that allows for a 3rd party to use that key for other purposes. What private key systems allow for this? PGP, S/MIME, PKI?
12
votes
2answers
11k views

OpenSSL PKCS#7 vs. S/MIME

OpenSSL 1.0.1c onwards seems to offer CMS support. I have difficulty understanding the difference between smime and pkcs7. S/MIME specs are layered on PKCS#7 (so says Wikipedia). Now in openssl I ...