# Secure encrypt-then-sign with RSA

I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.

However, I have encrypted data that I need to sign, to prove the author of the encrypted data.

1. Encrypt wth recipient's public key
2. Sign with author's private key
3. Concatenate cipher text with signature

From reading papers such as this, it seems that the problems with sign-then-encrypt are quite subtle, but solutions are quite straightforwrd.

I haven't been able to turn up much on issues with encrypt-then-sign. I guess one problem is that someone could simply strip off the signature and replace it with their own. My first thought was to prefix the data with the author's public key before encrypting, but then the signature can only 'really' be verified by the recipient (public verification is more desirable for me).

What are the issues associated with encrypt-then-sign, and what solutions exist?

** Edit **

I thought of another potential solution to the problem of someone replacing the original signature with their own - using X.509 certificates. So in step 3 above we also concatenate the certificate of the author. When verifying the signature we check that the public key matches that of the certificate, and we also verify that the certificate was issued by a particular, trusted CA. With this scheme, not just anyone can replace the signature, only those who are issued a certificate from the trusted CA. Any issues with this approach?

-
Another problem is that the recipient's public key needs to go into what's signed. $\hspace{1.32 in}$ –  Ricky Demer Apr 27 '13 at 20:21
@RickyDemer I mention that in my question as a possible solution to the problem of someone replacing the signature –  MurrayA Apr 27 '13 at 20:23
I see where you mention putting the author's public key into what's encrypted, $\hspace{1.62 in}$ but I don't see where you mentioned what I said. $\:$ –  Ricky Demer Apr 27 '13 at 20:52
@RickyDemer sorry, I mis-read your comment - BTW, what is going on with the formatting of your last comment? –  MurrayA Apr 27 '13 at 21:19
That's my attempt at making the lines have approximately the same length. –  Ricky Demer Apr 27 '13 at 21:22

The primary problem with encrypt-then-sign (signing the ciphertext) relates to the difference between signing for the purpose of assigning responsibility vs for the purpose of taking credit. Encrypt-then-sign is OK for the former but not for the latter. The issue is quite subtle.

In particular, in your protocol, the recipient has no reason to believe the sender (signer) was ever aware of the contents of the plaintext. The signer must have been aware of the contents of the ciphertext and approved signing the ciphertext, but this does not mean that the signer knows or created the original message.