I'm trying to figure out which is the best way to get privacy and integrity together in public cryptography.
Alice needs to send multiple files $f$ (may be big) to Bob.
Alice computes the hash of the file $h(f)$.
Alice signs $h(f)$ with her private key.
Alice encrypts with Bob's public key $f$ and $Sig_a(h(f))$ resulting in the ciphertext $Enc_b(f, Sig_a(h(f)))$.
Only Bob can decrypt with his private key: privacy guaranteed. Once Bob decrypted, can verify Alice's signature.
In my opinion this protocol provides privacy and integrity together, right?
So, according to your answers, here's what i've understood:
- The protocol is terribly inefficient because it encrypts a large file using public cryptography. This would require to split the file in n chunks ($f_1,f_2,...f_n$) and to send to Bob $Enc_b(f_i, Sig_a(h(f_i)))$ for i = 1 to n. This may require a padding.
- A bad guy (Charles) that receives $Enc_c(f, Sig_a(h(f)))$ could decrypt it and re-encrypt it with Bob's public key and send it to Bob. No confidentiality.
- In order to fix this, Alice should perform $Enc_b(f,A,Sig_a(h(f),B))$
At this point we can say that:
- This protocol (as it is) MAY (depends on how it is implemented in practice) guarantee integrity.
- I would use Diffie-Hellman key-exchange protocol (the ephemeral version) to estabilish a secure channel and use symmetric cryptography.
Not even integrity is guaranteed. I've seen the so called "message malleability".