Sun Java System Communications Express |

Contents Index

> ## Signing and Encrypting Messages (S/MIME)

> Mail supports the Secure/Multipurpose Internet Mail Extension (S/MIME). To use the S/MIME features to sign or encrypt a message, you must meet all of the following requirements:

> - You have permission to use S/MIME
> - You have a smart card containing your private and public keys or you imported your keys to a local key store on your computer
> - Your computer has a card reading device attached to it if you are using a smart card
> - Your system administrator has published your public key so that other mail users can access it

> ### The Purpose of Keys and Certificates

> Your private key is used to sign your S/MIME messages and to decrypt incoming encrypted messages. Your public key is used by other mail users to encrypt messages intended for you.

> To assure other mail users that you are the true owner of a private or public key, information is associated with your keys that identifies them as only belonging to you. This information is referred to as a certificate. Keys and their certificates are issued from within your organization or purchased from a third-party vendor. Regardless of how the keys and certificates are issued, the issuing organization is referred to as a certificate authority (CA).

> #### Is the Key’s Certificate Valid?

> Before Mail uses a private or public key, it must locate the key and check its expiration date in the certificate against the current date. If the key has expired, you receive a message in a pop-up window, and no further S/MIME messages are created with that key. Depending on how your system is configured, a key’s certificate is further checked against a certificate revocation list (CRL) and if it matches a certificate on the CRL, Mail may or may not use the key, depending on how your system is configured.

> After a key’s certificate is determined to be valid, the key is used when sending, reading, forwarding, or replying to messages. A message can be:

> - Signed
> - Encrypted
> - Signed and encrypted

> #### Where are Keys and Certificates Stored?

> You typically have one private-public key pair, but multiple ones are permitted. Your keys and their certificates are stored in one of the two ways:

> - On a smart card

> The keys and certificates are encoded on a plastic smart card which is issued to you. To use your private key, insert the card into a device attached to your computer which reads the key and its certificate. Mail has access to your private key and certificate as long as the card remains in the device. To further safeguard who uses the smart card, a personal identification number (PIN) might be requested and verified before the content of your card is released to Mail.

> - In a local key store

> When smart cards are not used, you must obtain the keys and certificates electronically and import them to a local key store on your computer with the importing function of your browser. The importing process is done once for each key pair issued to you. See your browser’s online help for instructions to import a key and its certificate.

> #### Changing the S/MIME Settings

> There are initial S/MIME settings for Mail, set by your system administrator, that control whether all your outgoing messages are automatically signed, automatically encrypted, or automatically signed and encrypted. The initial settings also control whether the S/MIME checkboxes at the bottom of a Messenger Express window and in the Option - Settings window are displayed as checked (feature selected) or unchecked (feature deselected).

> Table 7 summarizes the use of these checkboxes.

> Table 7 S/MIME Checkboxes

> Text for Checkbox | Location | What You Do
> --- | --- | ---
> Sign Message | At the bottom of the window used for composing, forwarding, or replying to a message. | Check the box to sign the current message. Uncheck the box not to sign the current message.
> Encrypt Message | At the bottom of the window used for composing, forwarding, or replying to a message. | Check the box to encrypt the current message. Uncheck the box not to encrypt the current message.
> Sign all outgoing Messages | In the Options - Settings window, under the Secure Messaging option. | Check the box to sign all your messages automatically. Uncheck the box not to sign all your messages automatically. Note: You can override the setting of “Sign all outgoing Messages” on a message-by-message basis with the “Sign Message” checkbox.
> Encrypt all outgoing Messages | In the Options - Settings window, under the Secure Messaging option. | Check the box to encrypt all your messages automatically. Uncheck the box not to encrypt all your messages automatically. Note: You can override the setting of “Encrypt all outgoing Messages” on a message-by-message basis with the “Encrypt Message” checkbox.

> #### Example of Changing a Setting for All Your Messages

> In this example, the initial S/MIME settings for your messages cause all your messages to be automatically encrypted but not automatically signed. You want all your messages automatically signed too. To do that, you perform the following steps:

> 1. Click the Options tab.
> 2. Click Settings.
> 3. Under the Secure Messaging, select the checkbox next to Sign all outgoing Messages.
> 4. Click Save.

> #### Example of Changing a Setting for One Message

> In this example, the current S/MIME settings cause all your messages to be signed and encrypted automatically. You want to send a new message as signed but not encrypted. To do that, you perform the following steps:

> 1. Access the New Message window.
> 2. Compose a message.
> 3. Click the checkbox next to Encrypt Message at the bottom of the New Message window to deselect it.
> 4. Click Send to send the message as signed but not encrypted.

> All subsequent outgoing messages are signed and encrypted because you temporarily changed the encryption setting for only one message.

> ### What Can I Do With S/MIME?

> S/MIME allows you to exchange signed or encrypted email messages with other Mail users who have S/MIME privileges. You can also exchange messages with Microsoft Outlook users who have S/MIME privileges. The S/MIME checkboxes located at the bottom of a Mail window and in the Options - Settings window are used to request a signature or encryption for an outgoing message. For more information about the checkboxes, refer to Changing the S/MIME Settings.

> An S/MIME message, whether signed or encrypted or both, appears in your Inbox folder with a small icon at the end of the Subject line to indicate that it is an S/MIME message. For more information about the icons, refer to What Do the S/MIME Icons Mean?

> Table 8 is a summary of the mail actions you can do with S/MIME.

> Table 8 Allowed S/MIME Actions

> Mail Action | Description
> --- | ---
> Send a signed message, with or without attachments | When you send a message as signed, a signature is added to the message which ensures that the message is from you. Your private key is used to create the signature. For more information, refer to The Purpose of Keys and Certificates and What Do the S/MIME Icons Mean?
> Send an encrypted message, with or without attachments | When you send a message as encrypted, it is specially coded using the recipient’s published public key. When the message arrives at its destination with an S/MIME icon that indicates it is properly encrypted, the recipient is assured that no tampering occurred before receiving your encrypted message. For more information, refer to The Purpose of Keys and Certificates and What Do the S/MIME Icons Mean?
> Read a signed or encrypted message, with or without attachments | A signed or encrypted message carries a special S/MIME icon at the end of the message’s Subject line.You can read a signed or encrypted message from any of these mail folders for your account: Inbox folder Sent folder Drafts folder Trash folder A mail folder that you created and named For more information about the icons, refer to What Do the S/MIME Icons Mean?
> Forward a signed or encrypted message, with or without attachments | When you forward an S/MIME message, it is sent with the S/MIME features currently in effect for your outgoing messages, not with the S/MIME features it might have arrived with. It is up to you to ensure that the forwarded message is properly signed or encrypted. For example, you receive an encrypted message from user A and want to forward it to user C as encrypted. The current S/MIME setting for your outgoing messages is always to sign but not encrypt them. Without overriding those settings, you forward the message to user C. User C receives the forwarded message as only a signed message. The message that you received as encrypted is no longer encrypted when it reaches user C. For more information about overriding the S/MIME settings, refer to Changing the S/MIME Settings.
> Reply to a signed or encrypted message, with or without attachments | When you reply to an S/MIME message, it is sent with the S/MIME features currently in effect for your outgoing messages. The message you are replying to, which is part of your response, is not automatically sent with the S/MIME features it might have arrived with. It is up to you to ensure that your response and the original message is properly signed or encrypted. For example, you receive an encrypted message from user A and want to reply to it as an encrypted message. The current S/MIME setting for your outgoing messages is always to sign but not encrypt them. Without overriding those settings, you reply to the encrypted message. User A receives your reply and the original message they authored as only a signed message. The message that you received as encrypted from user A is no longer encrypted when it returns to user A. For more information about overriding the S/MIME settings, refer to Changing the S/MIME Settings.
> Save a draft message | If you need to save a draft of a new S/MIME message, it is stored in the Drafts folder as encrypted if that feature was selected. Ensure that the S/MIME features are set as desired before you eventually send the message. For more information about overriding the S/MIME settings, refer to Changing the S/MIME Settings.

> ### What Do the S/MIME Icons Mean?

> An S/MIME message carries an icon at the end of its Subject line to indicate whether it is signed or encrypted. Table 9 describes the icons.

> Table 9 S/MIME Icons

> Icon Image | Description
> --- | ---
> Pen over a sheet of paper | This message is signed with a valid private key.
> Broken pen over a sheet of paper | There is something wrong with the private key used to sign the message. Do not trust the signature.
> Key over a lock | This message is encrypted with a valid public key.
> Broken key over a lock | There is something wrong with the public key used to encrypt the message. Do not trust the contents of the encrypted message.

> ### Viewing the Java Console Messages

> A variety of operating messages can be written to the Java Console by the S/MIME applet as you process signed and encrypted messages. These messages are written to the console only if your system administrator has enabled the Java Console for you.

> To view the console messages:

> 1. Navigate to the Windows Control Panel.
> 2. Double click the Java Plug-in 1.4 icon.
> 3. Click the Basic tab.
> 4. Click the radio button for Show Console.
> 5. Click Apply.

Contents Index