S/MIME
Index
S/MIME
S/MIME is a standard for encrypting and signing MIME (Multipurpose Internet Mail Extensions) data. It is widely used for electronic mail. OpenSSL provides support for this type of functionality.
S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public-key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFC 8551. It was originally developed by RSA Data Security, and the original specification used the IETF MIME specification with the de facto industry standard PKCS #7 secure message format, called Cryptographic Message Syntax (CMS).
For the next operations let's assume that there are two entities, Alice and Bob who want to exchange and sign information using public key cryptography - to do this we will create key pairs and certificates (containing the public key) for each of them.
Create keys and certificates
Let's create a set of key pairs and certificates for Alice and Bob.
Create key pairs and CSR for certificate request
Create a CSR for Alice:
Create a CSR for Bob:
Request and issue the certificates
The following command is going to be used to issue the certificate for Alice:
Results in the following:
The following command is going to be used to issue the certificate for Bob:
Results in the following:
Encrypt MIME information
Alice will now encrypt a file (SecretMessage.txt) that she wants to send securely to Bob, using the public key contained in Bob's certificate (bob.crt) (which will have been obtained at some earlier time).
The result of the cipher is as follows:
Decrypt MIME information
Bob, after receiving the encrypted file (messageSecreta.txt.enc), will use his private key (bob.key), to decrypt the original content.
Sign MIME information
Alice, wants to sign the message and then send it to Bob. To do this, she does the following:
The result of signing the message is as follows:
Verify digital signature of MIME information
After receiving the message signed by Alice (mensagemsecreta.sig), Bob uses Alice's digital certificate. In this case, and to prevent OpenSSL from doing additional validations on the digital certificate (such as checking whether it was actually issued by a CA it trusts) the "-noverify" option is used.
Resulting in:
Last updated