Using ECIES in a file encryption protocol, I need to authenticate the sender, so I'm using ECDSA, and I'm wondering if signing the ephemeral public key(needed by receiver to derive the shared symmetric key) is the way to go? The goal is to prevent MitM from forging and sending a fake ephemeral public key. The code(C#) uses Inferno but it is easy to follow considering the explicit variable names and the comments:
internal static void Encrypt(CngKey receiverPublicDhm, CngKey senderDsa, string file, string text)
{
var plainTextBytes = text.ToBytes();
var ephemeralBundle = receiverPublicDhm.GetSharedEphemeralDhmSecret();
var ephemeralPublic = ephemeralBundle.EphemeralDhmPublicKeyBlob;
var sharedSymmetric = ephemeralBundle.SharedSecret;
// sign emphemeral public blob and plainText(so that MitM cannot forge a fake ephemeral public key)
var toSign = Utils.Combine(ephemeralPublic, plainTextBytes);
byte[] signed;
using (var ecdsa = new ECDsaCng(senderDsa) { HashAlgorithm = CngAlgorithm.Sha384 })
signed = ecdsa.SignData(toSign);
// ETM signature and plaintext
var toEncrypt = Utils.Combine(signed, plainTextBytes);
var encrypted = SuiteB.Encrypt(sharedSymmetric, toEncrypt.AsArraySegment());
using (var fs = new FileStream(file, FileMode.Create, FileAccess.Write))
{
// so the format is:
// [ephemeral public] (signed but not encrypted)
// [signature] [ciphertext] (both encrypted and MAC'd)
fs.Write(ephemeralPublic, 0, ephemeralPublic.Length);
fs.Write(encrypted, 0, encrypted.Length);
}
}
Edited: Fixed a typo in file format description