What are the differences between S/MIME and PGP? Which one should we invest in?
S/MIME and PGP both allow you to sign and encrypt messages to ensure confidentiality, integrity and authentication. The key difference is that they use different trust models. A trust model is a way of representing whether or not someone should be trusted, based on their relationships with other trusted entities. S/MIME uses a hierarchical “tree” trust model based on an existing Public Key Infrastructure (PKI). Root Certificate Authorities issue certificates to other Certificate Authorities (CAs) as well as to individuals. Those CAs in turn can issue their own certificates to other CAs and individuals. A person or group is trusted only if the Root CA is trusted. PGP uses a planar “web of trust” model. Root CAs issue PGP keys to other CAs and individuals. However, a key does not need to be traceable to a trusted Root CA in order to be trusted. For instance, a key can be trusted based on its relationship with an intermediary CA or with other individuals. Each trust model has its benefits
