E-mail encryption with S/MIME certificates

Fundamentals of S/MIME technology

S/MIME, which stands for "Secure/Multipurpose Internet Mail Extensions", is a widely used standard for securing email messages through encryption and digital signatures. Similar to SSL certificates, this standard enables users to ensure the confidentiality, integrity and authenticity of their electronic communications.

S/MIME is an extension of the MIME protocol (Multipurpose Internet Mail Extensions), which was originally developed to allow emails to include text, images, audio and video in a single message. S/MIME adds security features to MIME such as encryption and digital signatures based on asymmetric cryptography. Each message is signed with a private key and/or encrypted with the recipient's public key. The digital signature ensures the message has not been altered and verifies the sender's identity. The encryption ensures that only the intended recipient can decrypt and read the message.

The key components of S/MIME include:

• Digital certificates: These are required to distribute the public keys used for encryption or signature verification securely. Digital certificates are typically issued by a Certificate Authority (CA) and include information about the key holder as well as the public key.
• Public and private keys: A key pair, consisting of a public and a private key, is at the heart of S/MIME encryption and signing. The private key is kept secret and is used by the sender to sign messages and to decrypt encrypted messages. The public key is distributed freely so others can encrypt messages to the key holder or verify messages signed by them.

Differences from other encryption methods

Compared with other encryption techniques such as PGP (Pretty Good Privacy), S/MIME offers some specific advantages and differences:

• Standardisierung: S/MIME ist durch verschiedene RFCs (Request for Comments) standardisiert, was die Integration in kommerzielle E-Mail-Software erleichtert.
• Zertifikatsbasiert: Während PGP ein "Web of Trust"-Modell verwendet, bei dem Nutzer die Identität anderer Nutzer bestätigen, verwendet S/MIME eine hierarchische Vertrauensstruktur, die auf Zertifikaten von vertrauenswürdigen CAs basiert. Dies kann in geschäftlichen Umgebungen, wo Vertrauenswürdigkeit und rechtliche Nachweisbarkeit erforderlich sind, von Vorteil sein.
• Interoperabilität: S/MIME wird von den meisten modernen E-Mail-Clients unterstützt und ist oft einfacher in Unternehmensumgebungen zu implementieren, die eine strenge Compliance erfordern.

Durch die Nutzung von S/MIME können Organisationen und Einzelpersonen sicherstellen, dass ihre Kommunikation geschützt bleibt, was angesichts der steigenden Bedrohungen im Cyberspace von entscheidender Bedeutung ist.

Security aspects of S/MIME

S/MIME is a standard specifically designed to improve the security of e-mail communication. This is achieved through the encryption of e-mail content, the signing of e-mails to authenticate identity, and the protection of message integrity. Each of these measures plays a crucial role in the overall security strategy for e-mail systems.

Encryption of e-mail content

Encryption is a central aspect of S/MIME. It protects the confidentiality of e-mail messages by making the content unreadable to anyone who does not possess the corresponding private key to decrypt the message. This works as follows:

• Key exchange: Before a message is encrypted, the sender must have access to the recipient's public key. This key is used to encrypt the message.
• Encryption process: The sender uses the recipient's public key to encrypt the message. Only the recipient, who holds the corresponding private key, can decrypt the message.
• Security: As the private key is never transmitted, it remains protected. Even if an attacker intercepts the encrypted message, they cannot read it without the private key.

Signing emails to authenticate identity

Digital signatures are another important security feature of S/MIME. They not only confirm the sender's identity but also provide proof that the message has not been altered since it was signed.

• Signature process: The sender creates a digital signature with their private key. This signature is sent together with the message.
• Authenticity and integrity: The recipient uses the sender's public key to verify the signature. If the verification succeeds, this proves that the message indeed came from the stated sender and has not been altered since signing.

How S/MIME protects message integrity

Message integrity is essential to ensure that the content of an email has not been altered during transmission. S/MIME achieves this through the use of hash functions and digital signatures:

• Hash functions: When signing a message, a hash value of the message is first created. This hash value is then encrypted with the sender's private key to produce the digital signature.
• Verification: Upon receiving the message, the recipient also creates a hash value of the received message and compares this with the decrypted hash value from the signature. If the hash values match, the message has not been altered since signing.

Through these methods, S/MIME provides a robust solution to meet the security requirements of modern email communication by ensuring both the confidentiality and the authenticity and integrity of messages.

Creation and management of S/MIME certificates

The use of S/MIME certificates is a crucial aspect of email security, as they enable the encryption and authentication of messages. Below we look at how to obtain an S/MIME certificate, how the certificate creation process works and the role played by certificate authorities.

How to obtain an S/MIME certificate

Choosing a Certification Authority (CA): The first step to obtaining an S/MIME certificate is selecting a trusted Certification Authority. These CAs offer different types of certificates depending on the user's needs and security requirements.

Generating a key pair: Before applying for a certificate, a key pair consisting of a public and a private key must be generated. The private key must be kept secure while the public key is sent to the CA.

Application: The applicant must submit an application to the CA, which typically includes personal information and the public key. Some certificates may also require proof of identity.

Validation and issuance: The CA verifies the submitted information and issues the certificate, which contains the public key, information about the certificate holder and the CA's signature.

Certificate creation process

Key generation: The user generates a key pair consisting of a public and a private key.

Certificate Signing Request (CSR): The public key is combined with identity information in a Certificate Signing Request (CSR), which is then sent to the CA.

Validation: The CA validates the applicant's identity and other relevant details.

Certificate issuance: After successful validation, the CA signs the public key along with other certificate data to create the S/MIME certificate.

The importance of Certificate Authorities (CAs)

Certificate Authorities are trusted entities that issue and manage digital certificates. They play a central role in the security infrastructure by confirming the authenticity of certificate holders and thereby increasing trust in communications. A CA takes on the responsibility of guaranteeing the authenticity of public keys and ensuring they are used only by the legitimate holders.

Integration and use of S/MIME in email systems

The integration and use of S/MIME certificates in common email clients is an important step to ensure the security and authenticity of email communication. This describes how to set up S/MIME in two popular email clients, Microsoft Outlook and Mozilla Thunderbird.

Setting up S/MIME in Microsoft Outlook

Install the certificate:

First, the S/MIME certificate must be installed on the computer. This is usually done by double-clicking the certificate file and following the instructions in the installation wizard.

Outlook automatically recognises certificates stored in the Windows certificate store.

Configure the email account to use S/MIME:

In Outlook choose Datei > Optionen > Trust Center > Email Security.

Under the Encrypted Email section tick Use S/MIME for encrypted messages and digital signatures.

There you also select the certificate to use for signing and for encryption.

Sign and encrypt email messages:

When composing a new email you can find the Sign and Encrypt options in the Options menu.

Messages are then automatically signed with the private key and encrypted with the recipient’s public key.

Setting up S/MIME in Mozilla Thunderbird

Install the certificate:

In Thunderbird open Preferences > Privacy & Security and scroll to the Security section.

Under Certificates click View Certificates and then Import to add the S/MIME certificate.

Configure the email account to use S/MIME:

Select the email account, click to view Account Settings, and navigate to End-to-end encryption.

Here you can choose the previously imported certificate for signing and encryption.

Sign and encrypt email messages:

When composing an email you will find the Sign and Encrypt options in the toolbar of the message window.

Enabling these options will cause each email to be automatically signed and/or encrypted.

In both clients, the recipient must also support S/MIME and have the corresponding certificates configured for encryption and signature verification to work correctly. Setting up S/MIME contributes significantly to the security of e-mail communication by ensuring that messages remain private and the sender's identity is verified.

Challenges of S/MIME

While S/MIME offers considerable security benefits for e-mail communication, it also brings specific challenges and limitations. These issues can affect the widespread adoption and effectiveness of the standard. The main problems are discussed below, including compatibility issues between different e-mail clients, challenges in certificate management and concerns regarding usability.

Compatibility issues between different e-mail clients

One of the main problems when implementing S/MIME is compatibility between different e-mail clients. Not all e-mail programmes support S/MIME or implement it in the same way, which can lead to the following difficulties:

• Different implementations: Different e-mail clients may use different versions or implementations of S/MIME, which can cause problems when encrypting and decrypting messages.
• Configuration differences: The settings and configuration requirements for S/MIME can vary from client to client, making setup complicated for end users.
• Support on mobile devices: Integration of S/MIME into mobile e-mail applications is often less intuitive and can be limited, making use on smartphones and tablets more difficult.

Challenges in certificate management

Managing S/MIME certificates poses another challenge, particularly in larger organisations or where there is a large number of users:

• Certificate renewal: Certificates have a limited validity period and must be renewed regularly. This requires proactive management to ensure that expired certificates are not used.
• Certificate revocation: If a private key is compromised or an employee leaves the organisation, the corresponding certificate must be revoked quickly. The revocation process and the distribution of revocation information can be complex.
• Scalability: Managing a large number of certificates and keys, especially in an enterprise environment, can be logistically challenging and time-consuming.

S/MIME is a crucial standard for securing email communication that, through encryption and digital signatures, ensures both the confidentiality and authenticity of messages. Despite its broad security advantages, users and organisations face challenges, particularly around compatibility between different email clients, certificate management and usability. With ongoing technological development and improved user interfaces, however, S/MIME could play an even greater role in the future of secure digital communication.

Our article is based on our own experience and research as well as information from external sources.

Sources & further links on the topic:

https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Onlinekommunikation/Verschluesselt-kommunizieren/E-Mail-Verschluesselung/E-Mail-Verschluesselung-in-der-Praxis/e-mail-verschluesselung-in-der-praxis_node.html

https://support.microsoft.com/de-de/office/verschlüsseln-von-nachrichten-mit-s-mime-in-outlook-im-web-878c79fc-7088-4b39-966f-14512658f480

https://www.thunderbird-mail.de/lexicon/entry/80-e-mail-verschlüsselung-mit-s-mime/

https://www.psw-group.de/smime/