How to get Outlook 2013 to encrypt using AES and not 3DES

Question

In my company we are exchanging emails with a government authority once a month and they require us to encrypt those emails with encryption algorithm AES-128, AES-192 or AES-256. For the purpose we did purchase an email digital id from Trustwave

The computer from which we are sending the emails is running Windows 7 and using Outlook 2013 as email client.

The authority sent us their certificates and I did install them and attached them to their contact in Outlook. Then I did import our newly purchased certificate in Outlook from Options > Trust Center > Email Security and setup the required algorithm (AES-128).

All looks fine and now we try to send email to the authority but the email explicitly gets encrypted with 3DES algorithm ...

Then I send encrypted email with the same settings to my colleague and the email is encrypted with the right algorithm - AES-128 ...

I am not able to solve this problem in the last two weeks, I tried multiple times to reinstall all the certificates, to setup all possible different settings related to email encryption in Outlook, tried using The Bat email client but nothing solves the problem. Emails get explicitly encrypted with 3DES and the authority is not accepting our emails ...

I decided to ask here so I am open to suggestions how to approach this problem...

Answer 1

As I understand from the following Microsoft Outlook blog, your client needs to advertise to the recipient server that it can send mails in AES. As stated in the article:

The recommended approach for fixing this is for the recipient to change the certificate to include the SMIME Capabilities attribute. This way the recipient can advertise to Outlook what algorithms the sender should use to send encrypted message to the recipient.

Hope this helps!