I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function actually does:
The CryptSignAndEncryptMessage function creates a hash of the specified content, signs the hash, encrypts the content, hashes the encrypted contents and the signed hash, and then encodes both the encrypted content and the signed hash. The result is the same as if the hash were first signed and then encrypted.
If I understood correctly, this solution could be susceptible to an attack called surreptitious forwarding?
Surreptitious forwarding uses the naive "sign and encrypt" approach to allow B to forward a message of A, destined to B, to a third party C and make C think the message was from B, destined to C (although it was from A to B, and just forwarded by B). This is possible because B can decrypt the signed message and re-encrypt it for C. However, although a message can be forwarded "illegally", the actual message content cannot be changed.
Does this in turn mean, if I include the receiver in the signed data, I am not susceptible to this attack?