[8525, TyTN, MDA Vario II, JasJam ROM Development] MrGAN:
Although PGP may be nice, the unfortunate fact is that it doesn't just "hook in" nicely to WM6 right now.

The track favored by the industrial giants is S/MIME, which is what Outlook and Netscape use. OpenSSL also includes the basic plumbing to do S/MIME stuff.

Let’s try to compile a simple step-by-step description with this thread, so as soon as it is complete we can create a wiki entry.

Step1: Setup Outlook utilize s/mine

Step1.1: Making a new X509 certificate

First, get and install the latest version of OpenSSL (if your OS doesn't already come with it). For M$ Windows you will find a installer here.

Next, you'll need to make a key pair so go to the bin folder and type:

% openssl genrsa -des3 -out keyfile 1024

This will make a key pair file. The private key will be encrypted with Triple DES. This means that anytime you do anything with the private key (like sign a message), you'll have to provide a passphrase (which you set at generation time). If you don't want to do this, then leave -des3 out, but just know that anyone who gets a copy of your key file can sign messages from you and read your encrypted mail.

To allow that everyone who received a signed email from you can verify the signature, you should create now a Certificate Signing Request, to get it signed by some root certificate, but this is optional, you can also create your own Certification Authority. But as long as the recipient has not imported your CA root certificate, one will be cluttered by warnings and error messages every time a signed and or encrypted email is displayed.

So I propose to get it signed by any common public CA. I choose

Thawte as an example as they offer the service for free. But you can choose any other you like.

So go sign up with Thawte's Freemail program and request a new certificate. At this point, go to the bottom of the form where it says "Developers of New Security Applications ONLY". Check the box that says "Paste in CSR Certificate Enrollment". Then click the button right below.

On the next screen there's probably nothing to do but hit "next>" when it asks about your name.

On the next screen there's probably nothing you should do but choose all of your e-mail addresses and hit "next>". Thawte advises that not all mail clients can handle having multiple e-mail addresses attached to a certificate, which means that if you send e-mail to someone using one of these clients, they may get a warning that the certificate doesn't match the message's From: line.

Same thing on the next screen.

On the next screen, accept the default extensions.

On the next screen, you'll see instructions telling you to make your certificate request, with a 16 character garbage string as the Common Name. At this point, you should go back to the shell window and do:

% openssl req -new -key keyfile

Answer all the questions that openssl asks, but be sure and paste in the 16 character garbage string Thawte gave you for the Common Name. Copy and paste the certificate request into the box on the Thawte form and hit "Next>".

Make sure everything looks ok on the last screen and hit "Finish".

A short time later, you should get an e-mail telling you your new certificate is done.

Go to the page (link) in the e-mail save it to a file in the openssl/bin folder.

The saved SPC file is a simply DER encoded PKCS#7 file containing the certificates.

Next, type:

openssl pkcs7 -print_certs -inform DER -out certs.pem -in file (where file is the name of the file with the PKCS7 stuff)

You should get out a bunch of certificates. You'll need to look at the text above each one to find the one that is your certificate. The rest are part of Thawte's Certifying Authority. It turns out that if you want your messages to verify correctly, you must also include Thawte's intermediate CA key.

There should be 3 certificates. The file certs.pem will then contain all the certificates in PEM form, you can manually cut and paste them. The one whose identity is your e-mail address is your certificate. The one whose subject and issue are identical is the Thawte CA root. You won't need that one, since we'll include it in the trusted root file later if it is not already there. The 3rd one will have the CA root as the issuer and something else as the subject (which will be the same as the issuer of your certificate). You need to save that certificate as an additional certificate for signing. We'll refer to the file containing this cert as othercert.

When you're done with all of that the pieces you need to keep are the key file you generated at the beginning (remembering the passphrase, if you set one), the intermediate cert between the Thawte CA root and your cert, and the certificate chunk for your e-mail address you got out of the last step. You're now ready to use S/MIME!

Step1.2: Importing in OUTLOOK

Outlook uses the pkcs12 format. OpenSSL can import and export certificates and private keys so that you can use the same cert and key pair on all your mail clients. To move a keypair and cert from OpenSSL to Outlook, you need to export it:

% openssl pkcs12 -export -inkey keyfile -certfile othercertfile -in certfile -out mycert.p12

This will ask you for a passphrase. This phrase locks the .p12 file. Outlook will ask this passphrase later.

Now open Outlook and go to Extras and open something called like Thrust center (I just have a German version so I can just guess).

Go to Email Security and click on Import, select your p12 file, enter your passphrase and click on OK.

In the next window you have the option the change the security level, medium means it will ask just for your permission, high it will additional ask for a passphrase, which will be defined if selected (not the same as used for protecting the keys).

On the same page section secure email (or something like that) you can change the settings concerning ciphering and signing algorithm.

You should choose for signing not MD5 as it is considered as broken, better is SHA1 even if this one is something like semi-broken.

Further you should prefer strong algorithm for instance 3DES instead of DES.

Select S/mime as format and give the settings a name before saving.

Now you are ready to use s/mime for signing and encrypting!

Step2: WM 6

Next step would be to import it in pocket outlook by just copy it to the Hermes and click on it.