RFC 8551 — S/MIME 4.0

Q: What does the Introduction section cover in RFC 8551 — S/MIME 4.0?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8551 — S/MIME 4.0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Operations section cover in RFC 8551 — S/MIME 4.0?

The Operations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8551 — S/MIME 4.0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Algorithm Requirements section cover in RFC 8551 — S/MIME 4.0?

The Algorithm Requirements section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8551 — S/MIME 4.0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Certificate Handling section cover in RFC 8551 — S/MIME 4.0?

The Certificate Handling section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8551 — S/MIME 4.0. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 8551 — S/MIME 4.0?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8551 — S/MIME 4.0. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 8551 — S/MIME 4.0

Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 — end-to-end email encryption and digital signatures using public key cryptography for message confidentiality, integrity, and authentication.

Standards Track April 2019 ISO 27001

1. Introduction

▶

S/MIME provides end-to-end security for email messages through digital signatures (authentication + integrity) and encryption (confidentiality). Unlike DKIM/SPF/DMARC which protect the envelope, S/MIME protects the actual message content.

ISO 27001 Relevance: A.8.24 (Use of Cryptography) — encrypts email content at rest and in transit. A.8.12 (Data Leakage Prevention) — prevented even if email is intercepted. A.5.14 (Information Transfer) — secure information exchange mechanism.

2. Operations

▶

Operation	Provides	CMS Type	ISO Control
Sign	Authentication + Integrity	SignedData	A.8.24
Encrypt	Confidentiality	EnvelopedData / AuthEnvelopedData	A.8.24, A.8.12
Sign + Encrypt	All three	Nested	A.8.24, A.8.12

3. Algorithm Requirements

▶

Function	Algorithm	Status
Signature	ECDSA P-256 + SHA-256	MUST support
Signature	RSA-PSS + SHA-256 (2048+)	SHOULD support
Key Encryption	ECDH P-256	MUST support
Key Encryption	RSA-OAEP	SHOULD support
Content Encryption	AES-128-GCM	MUST support
Content Encryption	AES-256-CBC	SHOULD support

4. Certificate Handling

▶

Certificate discovery: Certificates can be included in signed messages, retrieved from LDAP directories (RFC 4511), or looked up via DNS (SMIMEA record)
Chain validation: Full X.509 path validation per RFC 5280
Revocation checking: CRL or OCSP (RFC 6960) verification required
Key usage: Certificates must have digitalSignature and/or keyEncipherment key usage

5. Security Considerations

▶

Forward secrecy: S/MIME does not inherently provide forward secrecy — compromise of recipient's private key exposes all past encrypted messages
Key escrow: Organizations may need key escrow for encryption keys (not signing keys) to recover encrypted data — A.8.24 consideration
Metadata exposure: S/MIME encrypts body but not headers (To, From, Subject) — use with header protection extension for full confidentiality
Algorithm agility: S/MIME 4.0 mandates modern algorithms — deprecate SHA-1, 3DES, RSA-1024