The hardest part of S/MIME encryption has never been the cryptography. It
is getting the recipient’s certificate before the first message.
Today we are publishing a draft of S/MIME Certificate Discovery (SCD), a
small, open specification that lets a mail gateway or mail client find the
certificate for an email address, or for a whole domain, automatically,
before any message is sent.
How it works, in three lines:
- A domain announces that it publishes certificates with one DNS TXT
record. - The certificates are plain files on a web server at a fixed name,
smimecert.yourdomain, fetched over HTTPS. - A certificate found this way is checked exactly as one that arrived in
a signed message: it must chain to a CA you already trust, name the right
address, and be valid and unrevoked. SCD finds certificates. It never
decides trust.
What makes it different from a key server or a certificate portal is that
there is nobody in the middle. SCD is federated, like email and DNS
themselves: every domain publishes for itself, in its own DNS zone and on
its own web server, with no registry, no enrolment and no central operator
who sees who is about to write to whom. A static folder of files is a
complete installation. Two organisations that both publish benefit
immediately, whatever the rest of the world does.
For organisations that encrypt at the gateway, SCD also supports a single
domain certificate, signed by the domain itself, so that a sender needs one
DNS query and one fetch for an entire correspondent organisation.
The design borrows deliberately from MTA-STS and from the OpenPGP Web Key
Directory, and it works without DNSSEC: a blocked or tampered lookup can
only ever add nothing, never take a certificate away.
We are building SCD into the CipherMail Gateway, for publishing and for
lookup, and we would like other implementers to pick it up. The draft is
open for comments:
#email #encryption smime #emailsecurity #pki #ciphermail