RE: Signing before Encryption and Signing after Encryption

You're quite correct. I can think of cases where I'd want to
have the encrypted text signed (more often by a machine than by
a human...), but you've reminded me why that's not an acceptable
substitute for signing the plaintext.

IFF you do the encryption with Asymmetric keys, Alice can encrypt
the message with both Bob's public key and her own private key,
but we've already talked about why Symmetric keys are more commonly
used for encryption.
"Sign after encryption" allows for a message to be encrypted by
anyone who has the symmetric key, and signed by someone else; "sign
before encryption" confirms that Alice signed the text and we don't
care who encrypted it.
And actually, "sign before encryption" happens *invisibly* all the
time, as signed messages may travel across encrypted links and be
automatically decrypted before delivery.

I stand corrected.

David Gillett


-----Original Message-----
From: Gregory Rubin [mailto:grrubin@xxxxxxxxx]
Sent: Tuesday, March 21, 2006 6:53 PM
To: gillettdavid@xxxxxxxx; security-basics@xxxxxxxxxxxxxxxxx
Subject: Re: Signing before Encryption and Signing after Encryption

The problem with signing after encryption is that it is
possible to strip the signature off and claim a message as
your own. Consider the following situation (encrypted text
is signed, not the plain text).

Alice wants to authenticate herself to Bob, so she composes a
message with secret information, encrypts it to Bob's public
key, and then signs it with her private key and sends it off.

Mallory intercepts the message. She can't read the message,
but she can strip off the signature so she now just has the
message encrypted to Bob's key. She now signs the message
with her key and sends it on.

Bob now receives the secret information in an encrypted
message with a valid signature by Mallory. Ergo, he believes
that Mallory knows this secret information. This is a problem.

If the signature is on the plain text as opposed to the
private text, this attack fails.

Greg Rubin


On 3/21/06, David Gillett <gillettdavid@xxxxxxxx> wrote:
Signing requires a private key -- therefore, it *must* be
Asymmetric. Asymmetric is typically much slower than Symmetric, so
you get things like SSL that use Asymmetric to protect the
exchange of
the Symmetric key used for actual payload encryption.

Signing after encryption allows the signature to be verified
before/without decrypting the payload. There are a variety of
circumstances in which that could be useful, which are
blocked if the
signing is done first. I can't think of any where the opposite is
true.

David Gillett, CISSP


-----Original Message-----
From: shyaam@xxxxxxxxx [mailto:shyaam@xxxxxxxxx]
Sent: Tuesday, March 21, 2006 9:28 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Signing before Encryption and Signing after Encryption

Hello All,
I was asked a question in an interview. I would like to know more
about this. I am sorry if it is really basic question.

What are the tradeoffs between Signing before Encryption
and Signing
after Encryption? Please do let me know on either case
when you use
a Symmetric Key and an Asymmetric key.

I am sure that this is a very basic question. I appologize again.

Kind Regards,
Shyaam

--------------------------------------------------------------
-------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The
Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting
experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business
Continuity
Planning, Computer Emergency Response Teams, and Digital
Investigations.

http://www.msia.norwich.edu/secfocus
--------------------------------------------------------------
-------------




----------------------------------------------------------------------
----- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE -
ONLINE The
Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched
consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity
Planning, Computer Emergency Response Teams, and Digital
Investigations.

http://www.msia.norwich.edu/secfocus

----------------------------------------------------------------------
-----





---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • RE: Signing before Encryption and Signing after Encryption
    ... I don't understand how a signature can work with a shared key. ... Signing before Encryption and Signing after Encryption ... University program offers unparalleled Infosec management education and the ...
    (Security-Basics)
  • Re: Signing before Encryption and Signing after Encryption
    ... Hash: SHA1 ... Encryption and Signing after Encryption ... are signature schemes that only require symmetric keys. ...
    (Security-Basics)
  • RE: Signing before Encryption and Signing after Encryption
    ... Signing before Encryption and Signing after Encryption ... verification of its property than might have been previously assumed. ... schemes that only require symmetric keys. ...
    (Security-Basics)
  • Re: protecting objects from being changed
    ... Do you have a link to the pgp encryption stuff? ... I considered using some sort of encrypting format to prove signing, ... Security issues are always fun. ... I'll point out that user authentication only address ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: protecting objects from being changed
    ... I considered using some sort of encrypting format to prove signing, ... I take as granted that if you're going to use encryption, you'll take the time to learn how to do it right. ... Security issues are always fun. ... I'll point out that user authentication only address signing in a strong way if there is some encrypted data available only to authenticated users that's involved in the signing. ...
    (microsoft.public.dotnet.languages.csharp)