# Can you fake messages from recorded message-history?

Lets assume Eve has a lot of PGP conversation with Alice and records all those messages. Bob is also regularly communicating with PGP with Alice.

If Bob doesn't care about not having a signature from Alice, could Eve send any of those recorded messages unchanged but without signature to Bob pretending it came from Alice?

-

If Bob does NOT care to check signatures (as in the question), Eve can send ANY message she wants to Bob pretending to be Alice, including but not limited to messages Eve got from Alice; all Eve needs is Bob's public key (which, as the name implies, is assumed public knowledge thus known to Eve) and straight use of PGP.

Therefore the right question is: Can Eve reuse signatures she got from Alice, so that Bob concludes that a message sent by Eve is from Alice, even though Bob DOES care to check signatures?

The answer is YES, if Eve sends to Bob a message with exactly the content the message had when signed by Alice. So if Alice sent to Eve a message like "Let's meet at the bar at 11 pm", Eve can impersonate Alice and send that same message to Bob, who might conclude he has an invitation from Alice, when that invitation really was for Eve, perhaps another bar than the one he expects, and/or a past day. PGP gives insurance to Bob that the message was signed by Alice, and gives him a chance to detect a change of day (for PGP signatures include a "signature time stamp"). PGP does NOT give insurance to Bob that the message was for him.

Note: having an history of many recorded messages only helps Eve by giving her a wider choice of messages she can send to Bob pretending they came from Alice; Eve can not cut and paste fragments from past messages to compose a new one.

-
Wouldn't it be fairly easy to add the email addresses in the To and Cc, and the hash of the message being replied to in the PGP-ed reply as well as the signature time stamp? If email clients checks those automatically, that would make it harder to forge a message through this type of email MITM. –  Lie Ryan Aug 15 '14 at 11:11
@Lie Ryan: yes, what you describe would be possible; it amounts to Alice always signing messages making explicit mention of the intended recipient(s) or/and context, or/and enforcing this in the cryptogram format. That's just not part of PGP, or of the PGP wrapper that I practice. –  fgrieu Aug 15 '14 at 12:40
@LieRyan: that kwould be DKIM, which could be implemented too –  rubo77 Aug 15 '14 at 13:16
@Rubo77: I know that DKIM signs the message's origin, but does it sign the intended recipient(s) or otherwise protect from replay of the same message to unintended recipients? If yes, any reference to how? –  fgrieu Aug 15 '14 at 14:15

To be sure that the message is from A, A has to encrypt it with his private key. Anyone can decrypt it using A's public key.

To be sure that the message is for B, A has to encrypt it with B's public key. Only B can decrypt it using his private key.

If you use both methods combined, you can be sure that the message is from A and for B.

But this does still not rule out Delay or Replay attacks. Against these, you would include a timestamp into the encrypted part of the message.

And then, still some messages could have been dropped by malicious third party...

-
Please read carefully before downvoting! I wrote that a message which is encrypted with Bob's private key does insure that Bob sent this message. Because the private key is private to Bob, and if someone else could encrypt the message without that key, PGP would be flawed and not hyped... –  Alexander Aug 15 '14 at 14:18
Apologies for my original comment (and other later mess-ups), it should have been: Encrypting a message with Bob's public key only proves that it was written for Bob inasmuch as the message remains secret. I maintain that the fragment "To be sure that the message is for B, A has to encrypt it with B's public key" is wrong when for B is understood as with B interpreting the message. $\;$ The passage "To be sure that the message is from A, A has to encrypt it with his private key" uses improper terminology, but is right after changing encrypt to sign. –  fgrieu Aug 15 '14 at 14:31
Sorry, but the cryptographer in me cringes when I hear someone saying "encrypt with the private key". You can do that with RSA; however, that doesn't work with just about any other public key algorithm. Instead, it is more useful to talk about signing the message (and that's what we generally actually do with RSA in any case). –  poncho Aug 15 '14 at 15:25