Previoulsy I had asked this question at https://stackoverflow.com/questions/18235983/can-s-mime-be-still-considered-secure but I feel this forum is topic-wise the right place.
Recently there has been a discussion whether secret service agencies have access to certification authorities. Also before that several CAs were facing security problems being attacked by hackers.
Given this, I am wondering whether S/MIME can be still considered secure. Some time ago I had generated a free email certificate from one CA. To my surprise the key had not been generated with a tool on my own computer; instead it was generated by the CA and emailed to me. I am wondering:
- If this CA is infiltrated by a secret service agency, will they have access to my private key and can use it to decrypt emails encrypted by my public key?
- Are there tools to generate S/MIME keys on an own computer? If so, is it possible to send only public keys to a CA to get them signed?