Skip to main content
Cryptography

Return to Answer

replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

The answer (to the title question) is no, due to a slight mixup in terminology. What Moxie says is (emphasis added)

if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.

Notice that he says MAC and not signature. The PGP group has discussed this too, so you are not alone in your concern.

In other words, mac-then-encrypt is not the same thing as sign-then-encrypt. Sign-then-encrypt is preferred to encrypt-then-sign. For more discussion on sign-then-encrypt see this question and answersthis question and answers.

The answer (to the title question) is no, due to a slight mixup in terminology. What Moxie says is (emphasis added)

if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.

Notice that he says MAC and not signature. The PGP group has discussed this too, so you are not alone in your concern.

In other words, mac-then-encrypt is not the same thing as sign-then-encrypt. Sign-then-encrypt is preferred to encrypt-then-sign. For more discussion on sign-then-encrypt see this question and answers.

The answer (to the title question) is no, due to a slight mixup in terminology. What Moxie says is (emphasis added)

if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.

Notice that he says MAC and not signature. The PGP group has discussed this too, so you are not alone in your concern.

In other words, mac-then-encrypt is not the same thing as sign-then-encrypt. Sign-then-encrypt is preferred to encrypt-then-sign. For more discussion on sign-then-encrypt see this question and answers.

Source Link
mikeazo
mikeazo
  • 38.9k
  • 9
  • 117
  • 182

The answer (to the title question) is no, due to a slight mixup in terminology. What Moxie says is (emphasis added)

if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.

Notice that he says MAC and not signature. The PGP group has discussed this too, so you are not alone in your concern.

In other words, mac-then-encrypt is not the same thing as sign-then-encrypt. Sign-then-encrypt is preferred to encrypt-then-sign. For more discussion on sign-then-encrypt see this question and answers.