0
$\begingroup$

This question already has an answer here:

Is there a difference in terms of security between

  1. An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature

    $ C = E_k(plaintext||\sigma)$

    where $E$ is a symmetric or asymmetric encryption function, II is a concatenation operator and

    $\sigma=h(plaintext)^k$

    where $h$ is a secure MAC (the key is assumed to be the same).

  2. A bit stream obtained by concatenating a ciphertext and the signature over the its corresponding plaintext

    $C=E_k(plaintext)||\sigma$

    where

    $\sigma=h(plaintext)^k$

  3. A stream obtained by encrypting the ciphertext of the plaintext concatenated with the signature over the respective ciphertext

    $C=E_k(E_k(plaintext)||\sigma)$

    where

    $\sigma=h(E_k(plaintext))^k$

Also, is there any risk due to using the same key for both encrypting and signing? I don't refer to the cases that do not involve recovering the key through other means other than passive or active attacks.

$\endgroup$

marked as duplicate by CodesInChaos Nov 11 '15 at 21:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ Are you talking about MACs or asymmetric signatures? If the latter, which algorithm? And which assumptions do you make about the encryption algorithm? $\endgroup$ – CodesInChaos Nov 11 '15 at 20:57
  • $\begingroup$ Asymmetric, RSA. The encryption algorithm can be either symmetric or asymmetric The assumptions are ciphertext indistinguishability: en.wikipedia.org/wiki/Ciphertext_indistinguishability $\endgroup$ – Sebi Nov 11 '15 at 21:05
  • $\begingroup$ And what assumptions do you make about $h^k$? Is it a secure MAC/PRF? If so, you should call it like that, and not call it hash, since without qualification that generally means an unkeyed hash. $\endgroup$ – CodesInChaos Nov 11 '15 at 21:09
  • $\begingroup$ But why? The attacker only sees the ciphertext. Any alteration of it will change bits in the signature making it invalid. Yes, $h^k$ is assumed to be a secure MAC. $\endgroup$ – Sebi Nov 11 '15 at 21:10
  • 1
    $\begingroup$ The duplicate discusses the difference between your three constructions, assuming different keys are used for encryption and MAC. For the same-key question, see Why can't I use the same key for encryption and MAC? on security.se. $\endgroup$ – CodesInChaos Nov 11 '15 at 21:15

Browse other questions tagged or ask your own question.