Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator.

Should we encrypt $S|M$ or $M|S$?

Does it even matter?

  • 2
    $\begingroup$ I'd doubt it matters, but the usual setting is to do M|S as this feels more natural and usually provides advantages from the processing flow i.e. you read the message in first and then read the signature and then verify it, just like you'd do with any contract (where you find your signature at the bottom and usually not at the top). $\endgroup$
    – SEJPM
    Commented Oct 13, 2015 at 12:15
  • 1
    $\begingroup$ Make sure to add in id of recipient before signing. $\endgroup$
    – mikeazo
    Commented Oct 13, 2015 at 12:18

1 Answer 1


Secure encryption does not care about how the data is ordered.

With the typical single use symmetric keys that hybrid encryption uses, I cannot think of a way it could matter one way or the other. With key reuse (if you used symmetric encryption on signed data), there are some cases where having the "randomness" from the signature in the first blocks might help, but that would mostly be papering over security holes.

In practice, having it at the end may be preferable if it allows for a streaming interface where the data gets encrypted and maybe even sent before all data is ready to be signed.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.