Do digital signatures without contextual information protect you against signed messages replay attacks?

Question

Consider this scenario:

• A signs a message to B using A's private key. A then encrypts the signed message with B's public key. A sends both plaintext and encrypted message to B so that B can verify.

• B receives the messages from A. B decrypts the signed message using B's private key and verifies that the plaintext message indeed comes from A.

• B then encrypts A's signed message with C's public key and sends it to C.

In this case, there is no way C can detect that it was B who sends the message to them. They will (mistakenly) think that it is A who sent the message right (Unless there is some other contextual information in the signed signature like timestamps or sequence number)?

Answer 1

A digital signatures proves that the signed message (and nothing else!) comes from the owner of the secret key. So you're right, C has no way of knowing who the original receiver was. This can be solved by including the intended recipient in the signed message e.g., something like

Sign(skA,"To: B; Content: ...")

Answer 2

Not really sure if this is a duplicate, but you are correct. In the case of sign and then encrypt is easy to solve, just by including some kind of an identification information inside the message, then sign it and then encrypt it. In the case of encrypt then sign this is not needed. Take a look at these [1] [2].

Answer 3

Good question and good thinking!

Yes, a secure digital signature scheme doesn't provide replay protection. Digital signatures only authenticate the origin of the messages in such way that others cannot impersonate.

And you've answered yourself - timestamps, sequence numbers, can help in protecting against replay attack. These types of small information have a common name: nonce. (I've linked to Security.SE because I think you're very much likely want to read more about it from there)