5
$\begingroup$

My assumption is that S/MIME almost always utilizes certificates as follows:

  • My certificate can be used to allow people to encrypt messages and send them to me.
  • My certificate (the same certificate) is used by me to sign messages and send them.

Is there an RFC reference that specifies this is a requirement for S/MIME?
I'm scanning through RFC 5751 and not seeing anything jump out at me...

$\endgroup$
3
  • $\begingroup$ Not to the point of the question, but related: For decrypting and signing, you'll obviously need the private key, not only the certificate (which contains the public key and some informations about you, together with a signature by someone else). $\endgroup$ Jun 6, 2012 at 12:56
  • 1
    $\begingroup$ Thanks, Paulo. I did some further research on this last night and seemed to find the answer in the RFC on SMIME: rfc5751. I discovered that you CAN use different certificates for signing and encryption. From section 2.5.3 of that RFC: The encryption key preference attribute allows the signer to unambiguously describe which of the signer's certificates has the signer's preferred encryption key. This attribute is designed to enhance behavior for interoperating with those clients that use separate keys for encryption and signing. $\endgroup$ Jun 6, 2012 at 13:12
  • 1
    $\begingroup$ Feel free to post this as an answer, if you think it answers your question. $\endgroup$ Jun 6, 2012 at 19:28

1 Answer 1

4
$\begingroup$

No, clients do not have to use the same certificates for signing and encrypting messages.

Actually, you already noted the reference yourself. Let me quote RFC 5751, section 2.5.3 on page 13:

2.5.3. Encryption Key Preference Attribute

The encryption key preference attribute allows the signer to unambiguously describe which of the signer's certificates has the signer's preferred encryption key. This attribute is designed to enhance behavior for interoperating with those clients that use separate keys for encryption and signing. This attribute is used to convey to anyone viewing the attribute which of the listed certificates is appropriate for encrypting a session key for future encrypted messages.

(bold-italic emphasis mine)

As the reference states, clients can (but do not have to) use separate keys for encryption and signing.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.