Sign + ETM in ECIES

Question

Using ECIES in a file encryption protocol, I need to authenticate the sender, so I'm using ECDSA, and I'm wondering if signing the ephemeral public key(needed by receiver to derive the shared symmetric key) is the way to go? The goal is to prevent MitM from forging and sending a fake ephemeral public key. The code(C#) uses Inferno but it is easy to follow considering the explicit variable names and the comments:

    internal static void Encrypt(CngKey receiverPublicDhm, CngKey senderDsa, string file, string text)
    {
        var plainTextBytes = text.ToBytes();                         

        var ephemeralBundle = receiverPublicDhm.GetSharedEphemeralDhmSecret();
        var ephemeralPublic = ephemeralBundle.EphemeralDhmPublicKeyBlob;
        var sharedSymmetric = ephemeralBundle.SharedSecret;

        // sign emphemeral public blob and plainText(so that MitM cannot forge a fake ephemeral public key)
        var toSign = Utils.Combine(ephemeralPublic, plainTextBytes);
        byte[] signed;
        using (var ecdsa = new ECDsaCng(senderDsa) { HashAlgorithm = CngAlgorithm.Sha384 })
            signed = ecdsa.SignData(toSign);

        // ETM signature and plaintext
        var toEncrypt = Utils.Combine(signed, plainTextBytes);
        var encrypted = SuiteB.Encrypt(sharedSymmetric, toEncrypt.AsArraySegment());

        using (var fs = new FileStream(file, FileMode.Create, FileAccess.Write))
        {
            // so the format is:
            // [ephemeral public] (signed but not encrypted)
            // [signature] [ciphertext] (both encrypted and MAC'd)
            fs.Write(ephemeralPublic, 0, ephemeralPublic.Length);
            fs.Write(encrypted, 0, encrypted.Length);                                                       
        }
    }

Edited: Fixed a typo in file format description

Answer 1

I disagree with Maarten Bodewes answer for your specific scenario/code:

1. Your ECDSA signing code does not leak information about the plaintext. However, even if it did, the signature and plaintext are Inferno-encrypted (ie. no affected by MiTM). In order to get to the ECDSA signature, one needs to decrypt first (ie. the plaintext is revealed on decryption anyway).

2. Your code is not signing ECDH public key. It is signing the hash over [ephemeral public key]+[plaintext]. And the resulting signature is Inferno-encrypted (safe against MiTM) and safe against recipient-tampering.

I believe there is nothing wrong with the approach you are taking. I offer no comments on your file format/code.