1
$\begingroup$

I've got the 2nd edition, 3rd printing. On page 35 it lists the steps for signing a document:

  1. Alice encrypts her message to Bob with KA and sends it to Trent
  2. Trent decrypts the message with KA
  3. Trent takes the decrypted message and a statement that he has received this message from Alice, and encrypts the whole bundle with KB
  4. Trent sends the encrypted bundle to Bob
  5. Bob decrypts the bundle with KB. He can now read both the message and Trent's certification that Alice sent it.

Ok, pretty straightforward. Then on page 36 it talks about the characteristics of this signature. Specifically it mentions:

  1. The signature is not reusable. If Bob tried to take Trent's certification and attach it to another message, Alice would cry foul. An arbitrator (it could be Trent or a completely different arbitrator with access to the same information) would ask Bob to produce both the message and Alice's encrypted message. The arbitrator would then encrypt the message with KA and see it did not match the encrypted message that Bob gave him. Bob, of course, could not produce an encrypted message that matches because he does not know KA.

I don't understand the "would ask bob to produce...Alice's encrypted message" part. Why would Bob ever have the message encrypted with KA? Bob is supposed to get a message encrypted with KB per steps 3 & 4. Giving Bob the KA encrypted message along with the KB encrypted one - which he can decrypt - only weakens the system by giving Bob a ciphertext and plaintext pairing from Alice's key.

What am I missing in this explanation?

$\endgroup$

1 Answer 1

2
$\begingroup$

Bob is supposed to pass back the message and the cryptogram that he received from Trent. This cryptogram includes an encryption of Alice's message using $K_B$. As Bob knows $K_B$, Bob could attempt a forgery by attaching Trent's statement and a fake message, but Trent can take the cryptogram received from Bob, decrypt it with $K_B$ to recover the alleged message, re-encrypt with $K_A$ and compare to the original message that he received from Alice. If Bob's alleged message does not match Alice's original, Trent can identify Bob as a bad actor; if Bob's message does match, Trent can identify Alice as crying "wolf".

The following may help: Alice knows $K_A$, Bob knows $K_B$, Trent knows both $K_A$ and $K_B$.

  1. Commitment Alices sends $C_A=E_{K_A}(m)$ to Trent.

  2. Notarisation Trent recovers $m=D_{K_A}(C_A)$ and sends $C_B=E_{K_B}(m|\mathrm{Statement})$ to Bob.

  3. Verification Bob recovers $m|\mathrm{Statement}=D_{K_B}(C_B)$

  4. Attempted reuse Bob generates spoof $m'$ and attempts to claim that he recovered $m'|\mathrm{Statement}$ at step 3.

  5. Call for arbitration Alice does not recognise $m'$ and alerts Trent to an attempted reuse, quoting $m'$.

  6. Call for evidence Trent asks Bob to send $C_B$

  7. Attempted forgery Bob may attempt to send $C'_B=E_{K_B}(m'\mathrm{Statement})$.

  8. Arbitration Trent recovers $D_{K_B}(C'_B)$ and checks if this is consistent with $m'$. He also compares $E_{K_A}(m')$ to $C_A$. If there is not a match he declares Bob a bad actor, but otherwise tells Alice that $m'$ does match his records as sent by her.

$\endgroup$
2
  • $\begingroup$ Thank you for taking the time to spell all that out! Your steps all make sense to me. So perhaps the book is not wrong, but rather just confusing in its wording? When it says "ask Bob to produce ... Alice's encrypted message" I take this to mean EKa(m). But do they in fact mean EKb(m)? The book also says "arbitrator would then encrypt the message with Ka and see it did not match the encrypted message that Bob gave him" which further implies, to me at least, the "encrypted message" Bob is passing is one encrypted with Ka. $\endgroup$
    – Jeff
    Feb 5, 2023 at 17:21
  • 1
    $\begingroup$ I guess this is why a more formal description of the protocol is required. I'm not a huge fan of overly formalized text, but in the end a description should be given that can only be interpreted one way, and that usually means a formal description is in order. $\endgroup$
    – Maarten Bodewes
    Mar 7, 2023 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.