3
$\begingroup$

The general scenario of hybrid encryption is to use public key cryptography for the exchange of a one time session key that can be used for the encryption of the plaintext with a symmetric encryption algorithm. A digital signature attached to that structure is what I know as a digital envelope. Furthermore, some resources agree that sign-encrypt-sign can help to prevent certain unlikely but possible attacks.

On the other hand, for strictly symmetric scenarios, the use of authenticated encryption is usually recommended as a default good practice.

Does it make sense to bring these two approaches together? Especially, would authenticated encryption (as opposed to semantically secure but unauthenticated encryption) provide any protection against any scenario not covered already by the digital signature?

Improve this question
$\endgroup$
2
  • $\begingroup$ Is "that structure" just the PK-encrypted-symmetric-key, or that together with $\hspace{1.78 in}$ the symmetrically encrypted plaintext? $\;$ $\endgroup$
    – user991
    Commented Jul 1, 2015 at 15:32
  • $\begingroup$ Being SK the session key, M the message, SE(K, M) the symmetric encryption of M with the key K, and AE(K, M) the asymmetric encryption of M with the key K, "that structure" would be C=AE(recipient public key, SK) || SE(SK, M). The final scheme would have the form C2=AE(recipient public key, SK)||SE(SK, M||sign(M))||sign(SE(SK, M||sign(M))) $\endgroup$
    – Sergio A. Figueroa
    Commented Jul 2, 2015 at 14:31

2 Answers 2

Reset to default
1
$\begingroup$

I suggest that you look at Signcryption; a short survey appears here, and efficient schemes appear here. Just signing then encrypting or vice versa in a naive way is not secure (especially in the multi-user setting). So you have to do this right. Once you have a concrete scheme, you then have to see what level of security the encryption scheme needs to be. Typically it does need to be CCA secure, and the way to build CCA-secure symmetric encryption is the same as authenticated encryption. (Note that doing hybrid encryption or KEM/DEM, you need both the asymmetric and symmetric parts to be CCA secure.) However, it really depends on exactly what you are doing. Look at the cited references as a starting point.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thank you! I stumbled upon signcryption a few days ago, but I ignored it since all the documentation I found pointed to a single author back in the 90's. These references give me a more promising starting point, but I guess my overall concern remains: has signcryption been sufficiently studied? Is it used as the building block on any protocol or algorithm? Are there effective advantages over the sign-encrypt-sign scheme? $\endgroup$
    – Sergio A. Figueroa
    Commented Jul 2, 2015 at 15:03
  • 1
    $\begingroup$ There are two different things that people have done with signcryption. One is to come up with scheme that are more efficient than separately encrypting and signing; personally I don't find them very interesting. The other is to develop rigorous definitions and show how to do it right. This is non-trivial, especially in the (realistic) multiuser setting. It's actually very easy to do right once you know how, but it's important to know that otherwise bad things can happen. I don't know if sign-encrypt-sign meets the proper definitions; you can check that :-). $\endgroup$
    – Yehuda Lindell
    Commented Jul 2, 2015 at 17:48
1
$\begingroup$

If by authenticated encryption we mean encrypt-then-MAC then that provides some mitigation against side channel attacks - timing, error responses etc - because it allows you to detect that the message has been tampered before you start decrypting it and in something hopefully close to constant time.

It is perhaps worth mentioning that in TLS the opposite structure to yours is used and the signature is on the outside of the "envelope". Asymmetric key signing is used to authenticate the channel (i.e. that you are talking to whom you think you are). Then MAC is used to authenticate the integrity of the messages that are sent via that channel.

Improve this answer
$\endgroup$
7
  • $\begingroup$ There seems to be an agreement about sign-then-encrypt-then-sign being a good practice. In that scenario, wouldn't the validation of the external signature (the one calculated over the encrypted message) be as efficient and time uniform as verifying the MAC in the encrypt-then-MAC setup? $\endgroup$
    – Sergio A. Figueroa
    Commented Jul 2, 2015 at 14:39
  • $\begingroup$ You'll get the same guarantee of integrity but there is a difference in privacy - the external signature is in plain text whereas the MAC requires knowledge of the shared secret to use and doesn't expose any information about the sender anyway. Even in the situation where you don't care about exposing the signature, signature verification is usually a more expensive operation than MAC verification. $\endgroup$
    – geoff_h
    Commented Jul 2, 2015 at 14:55
  • $\begingroup$ But if the external signature is computed over the encrypted content, what kind of information would it be leaking? About signature, it would need to be verified in any case, at least to verify the sender's identity. Having already verified the signature, would I win anything by verifying, in addition, a MAC? $\endgroup$
    – Sergio A. Figueroa
    Commented Jul 2, 2015 at 15:10
  • $\begingroup$ You leak the sender's identity. This may or may not be a problem depending on the use case. As I understand it, the main rationale for the external signature in sign-encrypt-sign is to prevent a replay attack - i.e. to prove that the recipient of the message is the intended recipient. This relies on the difficulty of reproducing the same shared secret as was used to encrypt when sending to the original, intended recipient. There are other ways to achieve this. $\endgroup$
    – geoff_h
    Commented Jul 2, 2015 at 15:28
  • 1
    $\begingroup$ My impression of the reason for sign-encrypt-sign is it helping when the PKE scheme is not CCA-secure. $\:$ (A CCA attack would probably involve some invalid ciphertexts, and the outer signature would identify the responsible party.) $\;\;\;\;$ $\endgroup$
    – user991
    Commented Jul 2, 2015 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.