I came to this article from another comment on Crypto StackExchange. After reading it, I am wondering if there is any benefit to using a digital signature on unencrypted S/MIME emails?
3 Answers
The article you linked to predates the S/MIME 3.2 spec.
If your client is sending S/MIME 3.2 messages, it should support header protection. Refer to RFC 5751 Section 3.1:
In order to protect outer, non-content-related message header fields (for instance, the "Subject", "To", "From", and "Cc" fields), the sending client MAY wrap a full MIME message in a message/rfc822 wrapper in order to apply S/MIME security services to these header fields. It is up to the receiving client to decide how to present this "inner" header along with the unprotected "outer" header.
When an S/MIME message is received, if the top-level protected MIME entity has a Content-Type of message/rfc822, it can be assumed that the intent was to provide header protection. This entity SHOULD be presented as the top-level message, taking into account header merging issues as previously discussed.
S/MIME 3.2 should be fine for encryption, authentication, nonrepudiation, or any combination thereof.
Since the header is being signed, including TO and FROM attributes, that defeats the impersonation attack described by the link.
So yes, the benefit S/MIME signing an cleartext message would be authentication and nonrepudiation - if your X.509 certificate includes digitalSignature and nonRepudiation as KeyUsages, that is (see RFC 2459 Section 4.2.1.3).
-
$\begingroup$ Thanks, that's what I was wondering about. Hopefully Mac OS X's mail app (and everyone else) is using S/MIME 3.2 $\endgroup$ Sep 28, 2014 at 6:46
Yes, of course there is a benefit to signing unencrypted emails. The article you cite is solely about the combination of signature and encryption; it doesn't directly say anything about signing unencrypted emails.
There is an important concern raised by the article which does apply to unencrypted emails, but that's because that concern applies equally whether the email is encrypted or not. The problem is that only the body of the email is signed. So when you receive a signed email (whether it's encrypted or not), you need to be careful not to implicitly assume anything about the context of the email. For example, when Alice signs “I love you” and sends it to Bob, Eve can forward the message to Charlie; Charlie will then see a signed message, guaranteed to have been written by Alice, and saying “I love you”. Charlie might assume that because he received the email, the “you” in the email is him; but this association is not warranted. All that Charlie can know is that Alice declared her love to someone, but not who that someone is. If Alice had wanted to send an unambiguous message, she should have signed “Dear Bob, I love you”.
The benefit to signing a non-encrypted email is that any recipient can verify that it was indeed you who wrote that non-encrypted email, unless your key was compromised (or the signing protocol has an exploit).