I'm studying for an exam and came across this question:

When an electronic signature of a message claimed to be produced by Alice is verified we typically verify (at least the first time):

  1. that the public key belongs to Alice by verifying that it has been signed (along with additional information) by a certificate authority (CA) who we trust (such a signature is called a "certificate"),
  2. that the verification algorithm accepts the signature as valid for the message.

Suppose that you receive public keys pkA, pkX, and pkY and signatures sA, sX, and sY such that:

  • VfpkA(sA,m)=1
  • VfpkX(sX,"Alice's public key is pkA")=1
  • VfpkY(sY,"X's public key is pkX")=1

where Vf denotes the verification algorithm of the signature scheme. You know that pkY belongs to the certificate authority Y. Is this is enough to be confident that Alice signed m?

I'm a bit confused but I'm leaning towards a 'no'. The trust in the ownership of pkA as Alice's public key is based solely on the endorsement by X and not on a direct verification by the CA. If X is malicious or compromised, pkA and sA could theoretically belong to someone else, such as Eve, and not Alice.

Is my reasoning correct?


1 Answer 1


I would concur with your interpretation, although the question is a little vague.

When the question says that we trust $Y$ does this mean that we trust $Y$ only to sign messages that are true? Or that it believes to be true to the best of its knowledge?

In either case there is nothing in the statement "$X$'s public key is $pk_X$" that should makes us think that $X$ is a similarly trustworthy individual. In the real world additional transfer of trust should be explicit and the signed statement from $Y$ would be to the effect of "$X$'s public key is $pk_X$ and they may act as a delegated authority on my part" which we would reasonably assume means the same level of trust and truthfulness can be ascribed to signed statements by $X$. In the absence of a specific delegation of trust we should not trust $X$'s signed statements to be true.

  • $\begingroup$ Thank you for your response! After posting my question, I came across a similar discussion on post which seems to touch on the same topic. Specifically, one of the replies suggests that if Y is a CA and we 'trust' them to perform their duties correctly, then we should logically also trust Alice's key, implying a 'yes' answer to my question. Do you think that that argument is invalid? @daniel $\endgroup$
    – user1
    Commented Feb 28 at 13:07
  • 3
    $\begingroup$ @user1: the conclusion in the question is correct: we should NOT trust that "Alice signed m". The answer correctly explains why: we have no reason to trust X when they signed "Alice's public key is pkA". Things could be different if Y had signed "X's public key is pkX and I hereby delegate to X my authority of designating which key is who's. X will sign messages to this effect with their private key matching pkX". There are options in X.509 certificates for just that sort of delegation. $\endgroup$
    – fgrieu
    Commented Feb 28 at 13:27
  • $\begingroup$ @user1: This is more in the realms of cybersecurity policy than cryptography, but that comment on the other question is not in-keeping with the modern zero trust principle of least privilege. $\endgroup$
    – Daniel S
    Commented Feb 28 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.