S/MIME and PGP are the two main protocols for securing email. S/MIME was developed by RSA to provide digital signatures, encryption, and other security services to messages following the MIME standard. It uses PKCS #7 and #10 standards and public key cryptography to authenticate senders and ensure message integrity and confidentiality. S/MIME can secure email as well as other protocols using MIME, like HTTP. It provides services like digital signatures, encryption, and non-repudiation of origin.

1. E-mail Security:
S/MIME and PGP

2. Email security protocols
 The two schemes that provide security services on email are:
 S/MIME (Secure/ Multipurpose Internet Mail Extension)
 PGP (Pretty Good Privacy)

3. Standard for email service: RFC 822
 Describes the standard for e-mail format.
 Overall structure is very simple
 Message = Envelope + Content
- Envelope: Whatever information is required to accomplish
transmission and delivery
- Content: The message body

4. Limitations of RFC 822
• Cannot be used to transmit:
– Executable files
– Images
– Audio files, etc.
• Text character set limited to ASCII.
• Transfer size is also limited.

5. MIME (Multipurpose Internet Mail Extension)
• Extension to RFC 822 framework
• MIME specification includes following elements:
– Defines new message header fields
– A number of content format are there to support
multimedia email
– Content Transfer encodings are defined

6. S/MIME

7. S/MIME (Secure/MIME)
 Originally developed by RSA Data Security Inc.
 Build on top two Public Key Cryptography Standards:
 "PKCS #7: Cryptographic Message Syntax”
 "PKCS #10: Certification Request Syntax“
 Commercially very successful.
 Application not limited to e-mail. Any protocol that
transports MIME objects can leverage these services
such as HTTP.

8. Security Services
• Digital Signature
Message origin
Authentication
• Digital Signature
Message
Integrity
• Encryption
Message
Confidentiality
• Digital Signature
Non repudiation
of Origin

9. S/MIME services
• enveloped data (application/pkcs7-mime; smime-type = enveloped-data)
– standard digital envelop
• signed data (application/pkcs7-mime; smime-type = signed-data)
– standard digital signature
– content + signature is encoded using base64 encoding
• clear-signed data (multipart/signed)
– standard digital signature
– only the signature is encoded using base64
– recipient without S/MIME capability can read the message
but cannot verify the signature
• signed and enveloped data
– signed and encrypted items may be nested in any order

10. S/MIME functions (Signed Data)
 Select a message digest algorithm (SHA or MD5)
 Compute message digest of the content to be signed.
 Sign message digest with signer’s private key.
 Prepare a block called SignerInfo that contains signer’s public
key certificate, an identifier for Message Digest algorithm, an
identifier for algorithm used to sign message digest.