# Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator.

Should we encrypt $S|M$ or $M|S$?

Does it even matter?

-
I'd doubt it matters, but the usual setting is to do M|S as this feels more natural and usually provides advantages from the processing flow i.e. you read the message in first and then read the signature and then verify it, just like you'd do with any contract (where you find your signature at the bottom and usually not at the top). – SEJPM Oct 13 '15 at 12:15
Make sure to add in id of recipient before signing. – mikeazo Oct 13 '15 at 12:18