Title: RE: [ebxml-msg] Sign and Encrypt
Dan,
My responses imbedded.
Bob
-----Original Message-----
From: Dan Weinreb [mailto:]
Sent: Monday, November 05, 2001 12:23 PM
To:
Cc:
Subject: Re: [ebxml-msg] Sign and Encrypt
Date: Mon, 05 Nov 2001 12:43:23 -0500
From: "Miller, Robert (GXS)" <>
I agree with David Fischer: almost always, you want to sign and
then encrypt rather than the other way.
MILR: Agreed. "almost always"
Well now, the 'King' sealed his envelopes with a wax stamp using the ring he
wore on his hand.
Having provided some precedence for 'encrypt then sign',
I don't think this is an example of "encrypt then sign". It's more
like doing both at once: the sealing wax ensures confidentiality,
integrity, and authenticity, all at once.
MILR: Confidentiality - NOT. The message may be intercepted and opened
Integrity - NOT. While the king sleeps, his aide gains entry into his
bedroom and applies his stamp to the seal
Auththenticity - Almost - See Integrity
Encrypt then sign provides an indication of where the message came from,
and 'freezes' the message content. It has value for messsge transport.
Sign then encrypt provides end-to-end C,I,A for the message content.
Encrypt then sign only provides seal to unseal CIA. Once the seal is
broken (the message is decrypted) there is no residual protection, as
your Bob and Alice scenario below demonstrates.
Problems with "encrypt then sign" include:
If Alice encrypts-then-signs a message and sends it to Bob, Bob can
decrypt it and verify the signature, but if Bob wants to show it to
Carol, and passes on the original message and cleartext, Carol might
accuse Bob of lying about which letter arrived in which envelope.
With sign-then-encrypt, Bob can decrypt and then give the signed
message to Carol.
MILR: Agreed
With sign-then-encrypt, an adversary can't remove a signature from
the message and add his own.
MILR: Agreed
And if the text to be signed is not visible to the signer (because
it's encrypted), the signature may have little legal force.
MILR: Agreed. Which is why the king should sign the content of the envelope
Reference: "Applied Cryptography" by Bruce Schnier, section
2.7 "Digital Signatures with Encryption".
MILR: Reference: King Henry VIII
-- Dan
