Does encrypting both the message and digital signature adds to the integrity of the digital signature?

Question

Reading Cryptography And Network Security Principles And Practices 6th Edition by William Stallings, I came across the following excerpt on digital signature that got me confused:

A -> B: M || E(PRa, H(M))

This method guarantees that A cannot later deny having sent the message. However, this technique is open to another kind of fraud. Bob composes a message to his boss Alice that contains an idea that will save the company money. He appends his digital signature and sends it into the e-mail system. Eventually, the message will get delivered to Alice’s mailbox. But suppose that Max has heard of Bob’s idea and gains access to the mail queue before delivery. He finds Bob’s message, strips off his signature, appends his, and requeues the message to be delivered to Alice. Max gets credit for Bob’s idea. To counter such a scheme, both the message and signature can be encrypted with the recipient’s public key:

A -> B: E(PUb, [M || E(PRa, H(M))])

Where

• A -> B: A is the sender (Bob), B is the recipient (Alice)
• M = Message
• E = Encryption function
• PRa = A's private key
• H = Hash function
• PUb = B's public key

My understanding of digital signature is that by decrypting with Bob's public key, Alice already knows that it was signed by Bob (provided Alice is guaranteed to have Bob's real public key, which is not discussed in this excerpt). So if Max replaces Bob's signature, Alice will be alerted already that the signature was forged. Encrypting the whole message as in the final solution does not add anything to the integrity of the signature, it only prevents from eavesdropping, right ?

Answer 1

First of all, the fact that A is Bob and Alice is B is a bit confusing.

In my explanation:

• A - Alice (receiver), has keys PRa, PUa

• B - Bob (sender), has keys PRb, PUb

The former approach has a couple of substantial drawbacks:

• The message is send in a plain text. Any one who has an access to a communication channel can read its content.

• The signature of a message hash is separated from the actual message. They are only concatenated together and as the signature has a fixed size it can be easily stripped from a content.

The first drawback allows Max to read a content and decide that he wants to commit a forgery as it makes sense for his agenda.

The second drawback actually allows him to forge the email. He can easily calculate H(M). Assuming Max knows Bob's public key he can strip of the H(M) "verifying" the signature with Bob's public key.

Then Max simply signs the H(M) with his private key (PRm) and substitutes block E(PRa, H(M)) with E(PRm, H(M)).

The result would be that the message looks like sent by Max as it's signed by his private key and nobody can detect that it was originally an idea of Bob.

The later approach with encrypting both content and a signature with Alice's public key guarantees that only Alice would be able to decrypt the whole packet (thus content + signature).

Max won't be able to substitute the signature with his own as he doesn't knows PUa. Neither M, nor H(M) is possible to recover for him.

When Alice would receive the message it would decrypt it with her own private key (PRa) and then verify the signature with Bob's public key (PUb) thus being sure that the message was indeed send by Bob.

This pattern would still lack integrity check but generally it's much better then the former one.