.. smartc-decryption.rst

.. _smartc-decryption:

==========
Decryption
==========

To decrypt an email via S/MIME with your YubiKey and Yubico Authenticator for iOS/iPadOS, ensure that you have fulfilled the listed prerequisites and then complete the following steps.

Prerequisites
=============

You have:

- :ref:`acquired <smartc-x509-certs>` a valid S/MIME certificate and private key associated with your email address
- :ref:`imported <import-label>` your certificate and key pair onto your YubiKey
- :ref:`provisioned <provision-label>` the public certificate to your iOS Keychain
- :ref:`installed <configure-supported-clients>` a compatible mail client
- :ref:`enabled <smartc-mail-config>` encryption/decryption in your mail client and configured the app to decrypt messages using your S/MIME certificate and private key
- received an email that was encrypted using your certificate's public key

.. note:: In order for a contact to send you an encrypted message, they need to retrieve a copy of your certificate and its public key. See :ref:`smartc-configure-enable-encryption` for more information.

Decrypt a message 
=================

#. In your mail client's inbox, select an encrypted email you would like to decrypt and view. 

   In ISEC7 Mail, encrypted messages in your inbox show a lock icon underneath the message timestamp.

   .. image:: images/isec7-encrypted.jpg
      :width: 400

   In Outlook, encrypted messages in your inbox show the phrase "This message is encrypted" underneath the subject line.

   .. image:: images/outlook-encrypted.jpg
      :width: 400

#. A pop-up from Yubico Authenticator will appear at the top of the screen. Click on the pop-up to open the Yubico Authenticator app to begin the decryption process with your YubiKey.

   .. image:: images/authenticator-alert.png
      :width: 450

#. Insert your YubiKey into your iOS/iPadOS device or scan your NFC-enabled YubiKey when prompted. 

   .. include:: includes/includes-ios-ipados-nfc-note.rst

#. Enter your PIV application PIN. For NFC connections, scan your key again when prompted.

   The default PIV application PIN is 123456. If you do not know your PIN and your YubiKey is managed by your organization, reach out to your IT admin for assistance.

   .. include:: includes/includes-piv-pin-blocked-warning.rst

   .. include:: includes/includes-ios-keyboard-usb-c-note.rst

   .. image:: images/enter-pin.png
      :width: 400

#. If you entered the correct PIN and the PIN authentication operation was successful, you will see a green check mark. 

   .. image:: images/smartc-success-outlook.jpg
      :width: 400

#. Click on the name of your mail client in the upper left corner to return to your mail app and view your decrypted message. 

   .. image:: images/outlook-decrypted.jpg
      :width: 400

   .. note:: If you selected the wrong certificate during mail client configuration, decryption operations will fail.