CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.2  Email

2.2  Email 1 2.2.2  PGP

S/MIME, or Secure/MIME, provides sender authentication and message privacy for email. It was developed by RSA Security¹⁶⁶, and uses standardized formats for message data and digital certifications -- the PKCS #7 data format for messages, and X.509v3 format for digital certificates used for authentication (see chapter 4 for more information). S/MIME is a scalable secure email solution in which the standard hierarchies used in managing X.509v3 digital certificates are used to handle the chores of public key exchange and certificate authentication. For symmetric encryption, S/MIME can use 3DES, DES and RC2 algorithms.¹⁶⁷

One popular package that supports S/MIME is Microsoft Exchange with the Outlook client. Netscape clients also support it – since S/MIME is based on the same PKI as SSL, it has proven straightforward to implement in web browser email clients.

Unlike PGP, most implementations are not open-source-based, so implementations have not necessarily been as closely examined for potential security issues that PGP implementations have been.

2.2  Email 1 2.2.2  PGP