Manage Learn to apply best practices and optimize your operations.

Can the symmetric encryption algorithm for S/MIME messages be changed?

Encryption algorithm requirements ensure a base level of interoperability among all S/MIME implementations. Email clients, however, can add additional algorithms, provided they correctly identify which algorithms a particular message uses. Expert Michael Cobb explains how.

Michael Cobb
By
Which symmetric encryption algorithm is used to secure S/MIME messages? Is there a way to change and/or choose the algorithm?
In the 1990s, RSA Security developed S/MIME (Secure / Multipurpose Internet Mail Extensions), an encryption standard used today by most popular email clients. Whereas MIME specifies rules for how an electronic message, and its many parts, should be organized, version 3 of S/MIME describes how encryption information and a digital certificate can be included as part of the message body. Version 3 consists of several organizational notes, or requests for comments (RFCs), that cover the following cryptographic security services:

  • authentication
  • message integrity
  • non-repudiation of origin
  • privacy and data security

    To provide these services, S/MIME uses the X.509v3 format for digital certificates, along with various encryption algorithms. Non-repudiation actions, for example, require a public-key algorithm, while privacy and data security need a fast and efficient symmetric encryption algorithm.

    RFC 3370 identifies the algorithms that all S/MIME version 3 software must support. These are Secure Hash Algorithm 1 (SHA-1) and Message Digest-5 (MD5) for hashing, Digital Signature Algorithm (DSA) and RSA for signatures, and RC2 and triple Data Encryption Standard (3DES) for message encryption. The requirements ensure a base level of interoperability among all S/MIME implementations. Email clients, however, can add additional algorithms, provided they correctly identify which algorithms a particular message uses.

    The United States government no longer restricts encryption strength, and the default encryption algorithm in Outlook, Outlook Web Access and most email clients is 3DES. Although it is slower than the original DES, the triple Data Encryption Standard is more secure. When Microsoft Outlook runs on a 40-bit operating system that does not have 128-bit encryption capabilities, it uses the RC2 algorithm by default.

    Depending on the email client you use, it can be tricky to change this default setting. The figure below shows the security properties that you can set in Outlook Express 6, which include the encryption algorithm. In Outlook 2003's online help feature, there is no mention of how to change the algorithm. However, there is no particular reason to need to change this setting.


    Figure 1: Outlook Express 6 Security Settings

    More information:

  • Expert Joel Dubin explains PGP and S/MME's distinct approaches to email coding.
  • Visit our resource center for news, tips and expert advice on how to use SMIME/PGP encryption methods to secure email transmissions.
    • This was last published in September 2007

    Dig Deeper on PKI and digital certificates

    SearchCloudSecurity
    SearchNetworking
    SearchCIO
    SearchEnterpriseDesktop
    SearchCloudComputing
    ComputerWeekly.com
    Close