Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In addition to the titular question, are the two technologies compatible? If so, under what circumstances?

What are the relative benefits of the two technologies?

share|improve this question
up vote 20 down vote accepted

S/MIME and PGP are incompatible, but they do use similar concepts (asymmetric encryption and public key certificates).

The biggest difference is that S/MIME is based on X.509 public key infrastructure and has the same issues as with SSL: if you want a certificate that will be shown as "valid" to other users, you have to obtain one from a CA that everyone "trusts", and this costs money. The CA cannot always be trusted, too; see recent Comodo pwnage. The "X.509" page on Wikipedia has a nice list of issues.

On the other hand, in OpenPGP you create your own certificate, and validate other users' certificates using "web of trust". There are no authorities, besides yourself and your immediately trusted friends, who determine whether someone's key matches their real world identity. (This, however, can sometimes be hard to do if you don't know the person at all.) WoT is not without problems either, but (IMHO) they are smaller than those of PKI.

PGP/GPG Mostly used in *Nix ( Linux ; Unix ) Operating Systems, where e-mail clients, for example, has this feature built-in.

S/MIME is mostly used in Windows Operating systems, where it is built-in in Microsoft's E-mail client software products.

Also, from other perspective of "purpose of signing and/or encrypting email", there is interesting information in this book: "Inside Windows Server 2003. Autori: William Boswell. Page #975"

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .