User guide

Data flow: Viewing an attachment that is encrypted
using S/MIME encryption, PGP/MIME encryption, or
OpenPGP encryption
1. The BlackBerry device sends the message key and a request for the attachment data to the BlackBerry Enterprise
Server.
2. The BlackBerry Enterprise Server uses the message key to decrypt the email message and access the attachment data
that corresponds to the data in the attachment header. The BlackBerry Enterprise Server decrypts the attachment and
sends the rendered attachment data to the device.
3. The device displays the attachment.
To help protect the decrypted attachment data that the device stores, you can turn on content protection.
Data flow: Sending an S/MIME-protected email
message that contains attachments that are located on
a device
On a BlackBerry device that is running BlackBerry 7 or later in a Microsoft Exchange environment, you can use the S/MIME
Attachment Support IT policy rule.
The S/MIME Attachment Support IT policy rule determines how a device responds when a BlackBerry device user sends a
new S/MIME-protected message with an attachment, forwards an S/MIME-protected message with an attachment, or
replies to an S/MIME-protected email message with an attachment. By default, this rule is set to the "End-to-End or Trusted
BES" value. When the user composes and sends an S/MIME-protected message that includes attachments that are
located on the device, it uses End-to-End mode. In all other scenarios (even when a user forwards an S/MIME-protected
message after downloading the original message attachment to the device), the device uses Trusted BES mode.
1. A user performs the following actions when the user composes an email message:
a Attaches at least one file to the email message
b Selects the S/MIME encoding action for the email message (for example, sign, encrypt, or sign and encrypt using S/
MIME)
c Sends the email message
2. The email application on the device performs the following actions:
a Generates an email message including attachments
b Encrypts, signs, or encrypts and signs the email message using S/MIME
Security Technical Overview Extending messaging security to a device
128