1
$\begingroup$

I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation.

I thought that I should only sign using a private key (which isn't in my possession). How do I sign my encrypted data?

|improve this question
$\endgroup$
  • $\begingroup$ If you want to have non-repudiation as provided by signatures, you generate a key pair for a suitable signature scheme, give the public key to the other party, and then apply either a "encrypt-then sign" or a "sign-then encrypt" approach. You may have a look here $\endgroup$ – DrLecter Nov 8 '13 at 12:34
  • 1
    $\begingroup$ You should sign with your own private key, not with the receiver's public key. You need to create your own key-pair to do so. $\endgroup$ – CodesInChaos Nov 8 '13 at 13:52
  • $\begingroup$ Clearly, you have to generate your signing key pair in addition to the public key you have received for encryption, i.e., appy the "encrypt-then sign" or "sigh-then encrypt" by using the other parties public encryption key and your private signing key. Just to make my previous comment unambigious. $\endgroup$ – DrLecter Nov 8 '13 at 14:54
1
$\begingroup$

This is impossible - the receiver knows nothing about you so there's no way he can assure that the sender is in fact you.

|improve this answer
$\endgroup$
  • $\begingroup$ Makes me think: Sender could sign the data package using own keys and make sender's public key available to everyone, so receiver could verify the data package to be coming from the correct origin… like it's usually done. Why wouldn't that work in this case? (I definitely must be missing something; please help set my head straight.) $\endgroup$ – e-sushi Nov 8 '13 at 14:43
  • 1
    $\begingroup$ Presumably this is because there's no way of knowing that the public key you verify the signing against does indeed belong to the claimed sender? After all, anyone who's sending a fake message can just as easily generate their own keypair and publish their public key.If the sender already has a public key they can prove is theirs, then they can use it to sign the message. $\endgroup$ – figlesquidge Nov 8 '13 at 16:07
  • 1
    $\begingroup$ @e-sushi So how would he prove that the sender's public key is in fact the sender's key? $\endgroup$ – orlp Nov 8 '13 at 16:22
  • 1
    $\begingroup$ Clearly, if the involved public keys are not authentic or you have no pre-shared secret then you run into troubles. $\endgroup$ – DrLecter Nov 8 '13 at 16:37
  • $\begingroup$ Wait a minute… facepalm moment. Obviously forgot about the missing pre-shared secret in this situation. Thanks for the heads-up guys! $\endgroup$ – e-sushi Nov 8 '13 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.