S/MINE: Collecting and Analyzing S/MIME Certificates at Scale#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Adjacent pick 13–15 August 2025
Gurur Öndarö et al., Münster University of Applied Sciences; Fraunhofer SIT / ATHENE — Adjacent
- Why: The first broad empirical look at S/MIME's real-world PKI health (41M+ certificates), complementing the Verdict/X.509DoS/Trust-Agility picks above with a specific-but-large PKI ecosystem case study.
- What: Analysis of 41M+ real-world S/MIME certificates collected from public LDAP address books, finding the trust-chain and cryptographic health of the S/MIME PKI is generally improving (weak keys expiring, weak algorithms phasing out) but many certificates are issued by non-publicly-trusted CAs, and RFCs/clients should be more stringent about what counts as a valid S/MIME cert. (from abstract only)
- How: Large-scale collection and trust-chain construction from public LDAP directories, cross-referenced against CA/Browser Forum S/MIME Baseline Requirements. (from abstract only)
- Where applicable: General email security / S/MIME PKI ecosystem health; most directly useful to CAs and email client implementers.