# Encrypted vs unencrypted digital signatures [duplicate]

This question already has an answer here:

Is there a difference in terms of security between

1. An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature

$C = E_k(plaintext||\sigma)$

where $E$ is a symmetric or asymmetric encryption function, II is a concatenation operator and

$\sigma=h(plaintext)^k$

where $h$ is a secure MAC (the key is assumed to be the same).

2. A bit stream obtained by concatenating a ciphertext and the signature over the its corresponding plaintext

$C=E_k(plaintext)||\sigma$

where

$\sigma=h(plaintext)^k$

3. A stream obtained by encrypting the ciphertext of the plaintext concatenated with the signature over the respective ciphertext

$C=E_k(E_k(plaintext)||\sigma)$

where

$\sigma=h(E_k(plaintext))^k$

Also, is there any risk due to using the same key for both encrypting and signing? I don't refer to the cases that do not involve recovering the key through other means other than passive or active attacks.

## marked as duplicate by CodesInChaosNov 11 '15 at 21:14

• And what assumptions do you make about $h^k$? Is it a secure MAC/PRF? If so, you should call it like that, and not call it hash, since without qualification that generally means an unkeyed hash. – CodesInChaos Nov 11 '15 at 21:09
• But why? The attacker only sees the ciphertext. Any alteration of it will change bits in the signature making it invalid. Yes, $h^k$ is assumed to be a secure MAC. – Sebi Nov 11 '15 at 21:10