Our Expectation on the Users' Experience with their Mobile Devices:-
(a) User_A (as an email sender on a mobile device) should be able to send an encrypted email to a recipient using X.509 public key certificate, retrieved from an organisation's departmental directory. User_A should also be allowed to sign the email using User_A's X.509 private key certificate, given that that both X.509 public key certificate and private key certificate are generated by a Certificate Authority (CA).
(b) User_B (as an email recipient on a mobile device) should be able to verify signature (if applicable) and decrypt a received encrypted email using his/her X.509 private key certificate to read the email. Without signing operations involved, User_B should be able to decrypt the received email in its encrypted form using User_B's private key certificate to read the email. In case signing operations are involved, User_B should also be able to verify the signature using User_A's X.509 public key certificate.
(c) NO encrypted contents (viz. the encrypted email, decrypted plaintext after decryption nor any private key certificate) shall be present permanently on mobile devices. It is NOT our expectation to have any pre-determined certificates as a prerequisite of the above steps. In addition, it is expected that all cryptographic operations involving users' PKI certificates shall be performed at back-end side only.
