Email encryption with S/MIME certificates

Maintaining the confidentiality and integrity of electronic messages is of paramount importance in our connected world. By using S/MIME certificates, e-mails can be securely encrypted and signed. The following article provides a comprehensive overview of the technology behind S/MIME and its application.

Fundamentals of S/MIME technology

S/MIME, which stands for "Secure/Multipurpose Internet Mail Extensions", is a widely used standard for securing e-mail messages through encryption and digital signatures. Similar to SSL certificates, this standard allows users to ensure the confidentiality, integrity and authenticity of their electronic communication.

S/MIME is an extension of the MIME protocol (Multipurpose Internet Mail Extensions), which was originally developed to enable e-mails to include text, images, audio and video within a single message. S/MIME adds security features to MIME such as encryption and digital signatures that are based on asymmetric cryptography. Each message is signed with a private key and/or encrypted with the recipient's public key. The digital signature ensures that the message has not been altered and confirms the sender's identity. The encryption ensures that only the intended recipient can decrypt and read the message.

The key components of S/MIME include:

• Digital certificates: These are necessary to securely distribute the public keys used for encryption or for verifying signatures. Digital certificates are typically issued by a certificate authority (CA) and contain information about the key owner as well as the public key.
• Public and private keys: A key pair, consisting of a public and a private key, is the core of S/MIME encryption and signing. The private key is kept secret and is used by the sender to sign messages and to decrypt encrypted messages. The public key is distributed freely so that other users can encrypt messages to the key holder or verify messages signed by them.

Differences from other encryption methods

Compared with other encryption techniques such as PGP (Pretty Good Privacy), S/MIME offers some specific advantages and differences:

• Standardisation: S/MIME is standardised by various RFCs (Request for Comments), which makes integration into commercial email software easier.
• Certificate-based: While PGP uses a "Web of Trust" model, where users validate the identity of other users, S/MIME uses a hierarchical trust structure based on certificates from trusted CAs. This can be advantageous in business environments where trustworthiness and legal verifiability are required.
• Interoperability: S/MIME is supported by most modern email clients and is often easier to implement in corporate environments that require strict compliance.

By using S/MIME, organisations and individuals can ensure that their communications remain protected, which is crucial given the increasing threats in cyberspace.

Security aspects of S/MIME

S/MIME is a standard specifically designed to improve the security of email communication. This is achieved by encrypting email content, signing emails to authenticate identity and protecting the integrity of messages. Each of these measures plays a crucial role in the overall security strategy for email systems.

Encryption of email content

Encryption is a central aspect of S/MIME. It protects the confidentiality of email messages by making the content unreadable to anyone who does not possess the appropriate private key to decrypt the message. This works as follows:

• Key exchange: Before a message is encrypted, the sender must have access to the recipient’s public key. This key is used to encrypt the message.
• Encryption process: The sender uses the recipient’s public key to encrypt the message. Only the recipient, who holds the corresponding private key, can decrypt the message.
• Security: As the private key is never transmitted, it remains protected. Even if an attacker intercepts the encrypted message, they cannot read it without the private key.

Signing emails to authenticate identity

Digital signatures are another important security feature of S/MIME. They not only confirm the sender’s identity but also provide evidence that the message has not been altered since it was signed.

• Signature process: The sender creates a digital signature using their private key. This signature is sent together with the message.
• Authenticity and integrity: The recipient uses the sender’s public key to verify the signature. If the verification succeeds, this proves that the message indeed originated from the stated sender and has not been altered since signing.

How S/MIME protects the integrity of messages

Message integrity is essential to ensure that the content of an email has not been altered during transmission. S/MIME achieves this through the use of hash functions and digital signatures:

• Hash functions: When signing a message, a hash value of the message is first created. This hash value is then encrypted with the sender's private key to produce the digital signature.
• Verification: Upon receiving the message, the recipient also generates a hash value of the received message and compares it with the decrypted hash value from the signature. If the hash values match, the message has not been altered since signing.

By these methods, S/MIME provides a robust solution to meet the security requirements of modern email communication by ensuring the confidentiality, authenticity and integrity of messages.

Creation and management of S/MIME certificates

The use of S/MIME certificates is a crucial aspect of email security, as they enable the encryption and authentication of messages. Below we look at how to obtain an S/MIME certificate, how the certificate issuance process works and the role of certificate authorities.

How to obtain an S/MIME certificate

Selecting a Certificate Authority (CA): The first step to obtaining an S/MIME certificate is to choose a trusted Certificate Authority. These CAs offer different types of certificates depending on the user's needs and security requirements.

Generating a key pair: Before applying for a certificate, a key pair consisting of a public and a private key must be generated. The private key must be kept secure, while the public key is sent to the CA.

Application: Applicants must submit an application to the CA, which typically includes personal information and the public key. Some certificates may also require proof of identity.

Verification and issuance: The CA verifies the submitted information and issues the certificate, which contains the public key, information about the certificate holder and the CA's signature.

Certificate creation process

Key generation: The user generates a key pair consisting of a public and a private key.

Request (Certificate Signing Request, CSR): The public key is packaged together with identity information into a Certificate Signing Request (CSR), which is then sent to the CA.

Validation: The CA validates the identity of the applicant and other relevant details.

Certificate issuance: After successful validation the CA signs the public key together with other certificate data to create the S/MIME certificate.

Importance of Certificate Authorities (CA)

Certificate Authorities are trusted entities that issue and manage digital certificates. They play a central role in the security infrastructure, as they confirm the authenticity of certificate holders and thereby increase trust in communication. A CA undertakes the task of guaranteeing the authenticity of public keys and ensures they are used only by the authorised holders.

Integration and use of S/MIME in email systems

The integration and use of S/MIME certificates in common email clients is an important step to ensure the security and authenticity of email communication. This describes how S/MIME is set up in two popular email clients, Microsoft Outlook and Mozilla Thunderbird.

Setting up S/MIME in Microsoft Outlook

Install the certificate:

First, the S/MIME certificate must be installed on the computer. This is usually done by double-clicking the certificate file and following the instructions of the installation wizard.

Outlook automatically recognises certificates that are stored in the Windows certificate store.

Configure the email account to use S/MIME:

In Outlook select File > Options > Trust Center > E-mail Security.

Under the Encrypted E-mail section tick the box Use S/MIME for encrypted messages and digital signatures.

There you also select the certificate for signing and encryption.

Sign and encrypt e-mail messages:

When composing a new e-mail you can find the Sign and Encrypt options in the Options menu.

Messages are then automatically signed with the private key and encrypted with the recipient's public key.

Setting up S/MIME in Mozilla Thunderbird

Install the certificate:

In Thunderbird open Preferences > Privacy & Security and scroll to the Security section.

Under Certificates click View Certificates and then Import to add the S/MIME certificate.

Configure the email account to use S/MIME:

Select the email account, click Show account settings, and navigate to End-to-End Encryption.

Here you can select the previously imported certificate for signing and encryption.

Sign and encrypt email messages:

When composing an email, the Sign and Encrypt options are available in the message window's toolbar.

Enabling these options will automatically sign and/or encrypt each email.

In both clients it is necessary that the recipient also supports S/MIME and has configured the appropriate certificates so that encryption and signature verification function correctly. Setting up S/MIME significantly enhances the security of email communication by ensuring messages remain private and the sender's identity is confirmed.

Challenges of S/MIME

While S/MIME offers considerable security benefits for email communication, it also brings specific challenges and limitations. These issues can affect the widespread adoption and effectiveness of the standard. The main problems are discussed below, including compatibility issues between different email clients, challenges in certificate management and concerns about usability.

Compatibility issues between different email clients

One of the main issues when implementing S/MIME is compatibility between different email clients. Not all email programmes support S/MIME or implement it in the same way, which can lead to the following difficulties:

• Different implementations: Different email clients may use different versions or implementations of S/MIME, which can cause problems when encrypting and decrypting messages.
• Configuration differences: The settings and configuration requirements for S/MIME can vary from client to client, making setup complicated for end users.
• Support on mobile devices: Integration of S/MIME into mobile email applications is often less intuitive and can be limited, making use on smartphones and tablets more difficult.

Challenges in certificate management

Managing S/MIME certificates presents another challenge, particularly in larger organisations or where there are a large number of users:

• Certificate renewal: Certificates have a limited validity period and must be renewed regularly. This requires proactive management to ensure that no expired certificates are used.
• Certificate revocation: If a private key is compromised or an employee leaves the organisation, the corresponding certificate must be revoked quickly. The revocation process and the distribution of revocation information can be complex.
• Scalability: Managing a large number of certificates and keys, especially in an enterprise environment, can be logistically challenging and time-consuming.

S/MIME is a crucial standard for securing email communication that, through encryption and digital signatures, ensures both the confidentiality and the authenticity of messages. Despite its significant security benefits, users and organisations face challenges, particularly regarding compatibility between different email clients, certificate management and usability. With continued technological development and improved user interfaces, however, S/MIME could play an even greater role in the future of secure digital communication.

Our article is based on our own experience and research, as well as information from external sources.

Sources & further links on the topic:

https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Onlinekommunikation/Verschluesselt-kommunizieren/E-Mail-Verschluesselung/E-Mail-Verschluesselung-in-der-Praxis/e-mail-verschluesselung-in-der-praxis_node.html

https://support.microsoft.com/de-de/office/verschlüsseln-von-nachrichten-mit-s-mime-in-outlook-im-web-878c79fc-7088-4b39-966f-14512658f480

https://www.thunderbird-mail.de/lexicon/entry/80-e-mail-verschlüsselung-mit-s-mime/

https://www.psw-group.de/smime/