Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - without interaction steps. But Sender must be authenticated. Could you advise well-known key management protocol to solve this problem?

I asked this question some times ago but it was deleted. Now I have found the exact answer and want to publish it.

share|improve this question
    
my answer is from PKCS#7 but I may publish answer only in 10 hours after question according to local policy. –  Kaponir Sep 28 '13 at 20:55
    
Does a standard public-key signing algorithm not suffice? If the recipient has the sender's public key, the sender can just sign with their private key and the recipient can verify the signature. –  B-Con Sep 28 '13 at 21:44
    
There are subtleties. $\;$ –  Ricky Demer Sep 28 '13 at 22:06
    
The question is what to sign(that is encrypt with private key). Data should not be encrypted with private key. Data should be encrypted by symmetric algorithm using some session key. By the way for this problem it is not important the concrete implementation of algorithm(RSA, ecdsa, ...) –  Kaponir Sep 29 '13 at 0:31
    
On the other hand, whether or not one needs non-repudiation is important. $\;$ –  Ricky Demer Sep 29 '13 at 0:37
show 2 more comments

1 Answer 1

There is an answer in PKCS#7 in section 11. Signed-and-enveloped-data content type. Below encryption with the signer's private key means signing process.

"The signed-and-enveloped-data content type consists of encrypted content of anytype, encrypted content-encryption keys for one or more recipients, and doubly encrypted message digests for one or more signers. The "double encryption" consists of an encryption with a signer's private key followed by an encryption with the content- encryption key.

The process by which signed-and-enveloped data is constructed involves the following steps:

    1.   A content-encryption key for a particular content-
         encryption algorithm is generated at random.

    2.   For each recipient, the content-encryption key is
         encrypted with the recipient's public key.

    3.   For each recipient, the encrypted content-
         encryption key and other recipient-specific
         information are collected into a RecipientInfo
         value, defined in Section 10.2.

    4.   For each signer, a message digest is computed on
         the content with a signer-specific message-digest
         algorithm. (If two signers employ the same message-
         digest algorithm, then the message digest need be
         computed for only one of them.)

    5.   For each signer, the message digest and associated
         information are encrypted with the signer's
         private key, and the result is encrypted with the
         content-encryption key. (The second encryption may
         require that the result of the first encryption be
         padded to a multiple of some block size; see
         Section 10.3 for discussion.)

    6.   For each signer, the doubly encrypted message
         digest and other signer-specific information are
         collected into a SignerInfo value, defined in
         Section 9.2.

    7.   The content is encrypted with the content-
         encryption key. 

A recipient opens the envelope and verifies the signatures in two steps. First, the one of the encrypted content-encryption keys is decrypted with the recipient's private key, and the encrypted content is decrypted with the recovered content-encryption key. Second, the doubly encrypted message digest for each signer is decrypted with the recovered content-encryption key, the result is decrypted with the signer's public key, and the recovered message digest is compared to an independently computed message digest..."

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.