How deeply does Real-World Cryptography cover S/MIME?

Explains the trust model and major integration failures, but stops short of configuration or implementation procedures.

S/MIME

S/MIME is a standard for securing email with encryption and digital signatures based on public-key cryptography.

When a company needs employees to exchange confidential email, S/MIME uses public-key infrastructure to bind identities to public keys. It extends MIME and normally runs over SMTP, securing the message body with encryption and digital signatures. section 10.3.3

S/MIME’s practical shape is defined by three choices:

Trust comes from a public key infrastructure rather than PGP’s web-of-trust model, making organizational identity management a natural fit. section 10.3.3 section 10.6
Email integration is incomplete: the body may be encrypted, while the subject and other headers remain exposed. section 10.3.3
Treat it cautiously: outdated cryptography, absent authenticated encryption, imperfect clients, and exfiltration attacks weaken its security. section 10.3.3 section 10.6

A company email ecosystem

A company can use employee onboarding and offboarding processes to establish and revoke trusted identities and public keys for internal email, though modern messaging applications may provide a better alternative. section 10.3.3 section 10.6

How Real-World Cryptography covers it

liveBook manning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

authenticated encryption with associated datacontrasts with · Authenticated encryption with associated data is a cryptographic construction that encrypts plaintext while authenticating the ciphertext and optional unencrypted associated data.
PGPalternative to · PGP is a cryptographic standard for protecting messages and files with public-key encryption, digital signatures, and key management.
public-key infrastructureuses · Public-key infrastructure is a framework of authorities, certificates, keys, policies, and procedures for establishing and managing public-key trust and digital identities.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.