Fedora Users — Re: OT: Email signing

Arthur Pemberton wrote:

Could someone briefly fill me in on the if, why and how of emailsigning (I do not mean signatures). I am sure I can google the how,but I would like opions and experiences.

OK, I presume that you mean cryptographic signing. Message signing canbe done with either SMIME or PGP. Both accomplish the same thing, andoperate in virtually the same way.

Why sign? It's all about trust. If you reliably sign your messages,the people with whom you exchange messages can configure their mailclient to trust the fingerprint of your certificate (or, they may trustsomeone who signed your certificate). They can trust that a messagewith your name on it, which has a valid signature, was written by youand has not been tampered with. They should also learn not to trustmessages that have your name on it, but no signature.

Which method you choose probably will be influenced most by who,exactly, you want to be able to verify your signatures. SMIME uses, inlarge part, the same infrastructure that is already in virtually everymail client to support SSL connections. That's one of the reasons thatSMIME is supported by nearly every major mail client available, out ofthe box. PGP does pretty much exactly the same thing, but requires anentirely separate infrastructure. I'm not aware of any major clientthat supports PGP by default; they require plugins, mostly. That givesSMIME a significant advantage if you want to sign messages, and havethat information be useful to a wide audience.