How many expert man-hours have been spent searching for bugs in PGP? See section “Does anybody really bother checking the PGP source code?
“. How many expert man-hours have been spent searching for bugs in S/MIME? Who can tell? One could possibly argue that the “core” S/MIME code has been checked extensively by those implementing the system (but note that different implementations of S/MIME use different cryptographic libraries), but remember that, in the context of security, code on the periphery (e.g. not just the cryptographic core) can have a direct impact on security. So we revert back to the “lack of peer review” issue, as presented in [GW96].
