Need to change encryption algorithm to AES-256 - mimekit

Question

I wrote a test program to read a users cert from the cert store, and encrypt some text. However, I realize that the encryption algorithm used is 3DES. I need to change this to AES-256. I read a similar post on here, but for me, i think my situation is slightly different...So, I'll get straight to the point.
Using the suggested method:
var recipient = new CmsRecipient("MyCert.cer");
recipient.EncryptionAlgorithms = new EncryptionAlgorithm[] {
EncryptionAlgorithm.Aes256
};
var CmsCollection = new CmsRecipientCollection();
CmsCollection.Add(recipient);
// Followed by calling ApplicationPkcs7Mime.Encrypt(CmsCollection, p7m);
I'm able to change the encryption algorithm... However my key-encryption algorithm, is not the same if I were to do it using my original method of simply using the MailboxAddress to encrypt. E.g.:
MimeMessage mm = new MimeMessage();
mm.From.Add(new MailboxAddress(from));
mm.To.Add(new MailboxAddress(to));
ApplicationPkcs7Mime.Encrypt(mm.To.Mailboxes, p7m);
Using the CmsRecipientCollection method, this is the result of my pkcs7m file:
You can see, that the key-encryption algorithm has changed to rsaOAEP,and the email client that I'm sending this message to cannot recognize this algorithm.
Whereas, using the Mailbox method to encrypt:
I'm stuck with 3DES, while the key encryption algorithm is correct...
So I guess, end of day, what I'm asking is, is there a way to get both key-encryption algorithm to be rsaEncryption, and the block cipher to be AES-256?
I saw an method UpdateSecureMimeCapabilities in the API reference, would this be able to do the job?
Also, I guess a more fundamental question is, why would the key-encryption algorithm change if both methods are essentially using the same cert?
Thanks!
Update:
So I created a custom class to override the GetPreferredEncryptionAlgorithm function, however it's still falling back to 3DES.
public class CustomWindowsSecureMimeContext : WindowsSecureMimeContext
{
public CustomWindowsSecureMimeContext () : base ()
{
}
protected override EncryptionAlgorithm GetPreferredEncryptionAlgorithm(CmsRecipientCollection recipients)
{
return EncryptionAlgorithm.Aes256;
}
}
Did I override it correctly?

Answer 1

The UpdateSecureMimeCapabilities method isn't going to help in your case. It's not used when enveloping data, it's only used when decoding signed messages (it's a way for you to update your database of S/MIME capabilities of the email clients used by your correspondents).
There is no way to specify a key encryption algorithm in MimeKit because I haven't been able to figure out how to specify it in BouncyCastle (used by any of the BouncyCastleSecureMimeContext subclasses) nor in Microsoft's CMS API (used by WindowsSecureMimeContext). It seems to make that decision on its own.
Whichever SecureMimeContext class you use, you can override the GetPreferredEncryptionAlgorithm() method(s) to provide your own algorithm for choosing an encryption algorithm that would be suitable to use to encrypt the message to all of the specified recipients -or- you could override the GetCmsRecipient() method which takes a MailboxAddress and creates a new CmsRecipient for that recipient.
The other option is to use the MimeKit.Cryptography.CmsRecipient[Collection] API's in order to set the CmsRecipient.EncryptionAlgorithms property which represents the encryption algorithms supported by that recipient's email client. If you set an array of EncryptionAlgorithms that includes Aes256 for each recipient, then that algorithm will be chosen.