a recipient after encrypting it with the recipient’s public key.

So, we can say that S/MIME and PGP are very similar in one aspect – both of them use public key cryptography to sign, encrypt, and decrypt emails.

Interested readers can get more information on PGP here: What is PGP?

S/MIME vs. PGP: The difference between S/MIME and PGP

From a user’s perspective, S/MIME and PGP are different in the way a user obtains his keypair. In S/MIME, the user has to obtain his keypair from a trusted Certificate Authority (What is Public Key Infrastructure and how does it work?). And, if the recipient wants to verify whether a public key is indeed the sender’s authentic public key and is not forged by some attacker, the recipient needs to verify the public key with a trusted authority and then use the key.

On the other hand, in PGP, there is a concept of signing a key pair. Every user needs to sign his own key pair as well as of others with whom the user wants to communicate. Signing key vouches for the authenticity of the public key.

For example, if Alice is sure that a public key belongs to Bob and no one else, she will sign that public key. If another user, Charlie, wants to verify the authenticity of Bob’s public key, Charlie can look at whoever has signed that particular public key. If Charlie knows Alice, he would be able to see that Alice has signed the public key, which in turn would increase the trustworthiness of the key. Moreover, while verifying someone else’s key, one can indicate his trust level on that key by specifying four levels of trust (full, marginal, none, unknown). So, one does not need any trusted central authority to verify a public key.

So, to summarize, both S/MIME and PGP use Public Key Cryptography, yet both are two different standards. The main difference is that S/MIME depends on a centralized trusted authority for the verification of public keys, but PGP does not need that.

I hope this helps. Interested readers who want to know more about how different malware and cyberattacks work and how we can prevent them may want to refer to the book “A Guide To Cyber Security.”