How can you securely send emails using S/MIME and PGP?

1 What is S/MIME?

S/MIME stands for Secure/Multipurpose Internet Mail Extensions. It is a standard that defines how to encrypt and sign email messages using certificates and public key cryptography. Certificates are digital documents that contain your public key and your identity information, such as your name and email address. They are issued by trusted authorities, called certificate authorities (CAs), that verify your identity and sign your certificate. To use S/MIME, you need to obtain a certificate from a CA and install it on your email client or web browser. You can then encrypt your emails with the recipient's public key and sign them with your private key. The recipient can decrypt your emails with their private key and verify your signature with your public key.

2 What is PGP?

PGP stands for Pretty Good Privacy. It is a software that allows you to encrypt and sign email messages using public key cryptography. Unlike S/MIME, PGP does not rely on certificates or CAs. Instead, you generate your own key pair, which consists of a public key and a private key. You can then share your public key with anyone you want to communicate with, and keep your private key secret. You can encrypt your emails with the recipient's public key and sign them with your private key. The recipient can decrypt your emails with their private key and verify your signature with your public key. PGP also uses a web of trust model, where you can endorse other people's keys and check their validity based on how many people you trust have signed them.

3 How to choose between S/MIME and PGP?

When deciding between S/MIME and PGP, there are several factors to consider. Compatibility is an important factor, as S/MIME is more widely supported by email clients and web browsers. However, some email providers may not support either method or may limit their functionality. Additionally, S/MIME is easier to set up and use, as you only need to obtain and install a certificate once. PGP requires more steps, such as generating and managing your keys, exchanging them with others, and verifying their trustworthiness. Cost is another factor to consider; S/MIME certificates may have a fee depending on the CA and the level of validation, while PGP keys are free to create and use. Lastly, trust is a factor; S/MIME certificates are backed by CAs that have established reputation and authority while PGP keys are based on your own judgement and the network of people you trust. Both methods have potential risks, such as compromised or revoked certificates, or forged or expired keys.

4 How to use S/MIME?

To use S/MIME, you need to obtain a certificate from a CA. Different types of certificates are available, such as personal, organizational, or domain certificates. Some CAs offer free or low-cost certificates, while others charge more for higher levels of validation and security. Then, install the certificate on your email client or web browser. The settings can usually be found under the security or encryption options of your email account or browser. Finally, you can send and receive encrypted and signed emails. When you compose an email, you can choose to encrypt it with the recipient's public key, sign it with your private key, or both. You can also attach your certificate to your email so that the recipient can verify your identity and encrypt their reply. When you receive an email, you can check the encryption and signature status as well as view the sender's certificate details.

5 How to use PGP?

Using PGP requires several steps. Firstly, you must generate a key pair with software or services like GnuPG, Mailvelope, or ProtonMail. You will need to provide your name, email address, and passphrase and select the key size and expiration date for security and performance. Secondly, you should share your public key with others. You can upload it to a key server or send it via email. Additionally, you can publish it on your website or social media profiles. Thirdly, you can send and receive encrypted and signed emails. When composing an email, you can choose to encrypt it with the recipient's public key, sign it with your private key, or both. You can also attach your public key to the email for verification purposes. Lastly, you should manage your keys and trust by updating, revoking, or renewing them as needed and signing other people's keys. A key manager such as Kleopatra or Enigmail can help with these tasks.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?