I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, integrity and authenticity. I have to use the signature scheme, such that some third party can prove authenticity and integrity of the message. I tried it this way:

$c \gets \operatorname{Enc}_{ke}(m)$

$\sigma \gets \operatorname{Sign}_{sk}(c)$

$t \gets \operatorname{MAC}_{km}(c||σ)$

$\operatorname{Output} (c,t,σ)$

Does this protect the mentioned properties or: Is there any problem with Enc-Sign-Mac?

  • $\begingroup$ MAC's are generally symmetric. In that case we generally use the term "secret key". But if you already have a secret key, then you can use that to perform authenticated encryption. I'm not saying that this question is bad; it's about understanding when to use the primitives, but be aware that this is a theoretical construction. $\endgroup$ – Maarten Bodewes Mar 28 '16 at 12:34
  • $\begingroup$ What particular means does the third party have to prove those measures? $\endgroup$ – Maarten Bodewes Mar 28 '16 at 12:44
  • $\begingroup$ Enc-Sign-Mac doesn't hide the sender's identity from eavesdroppers. ​ ​ $\endgroup$ – user991 Mar 28 '16 at 13:15
  • $\begingroup$ Is there any better way to combine authenticated encryption with signatures? $\endgroup$ – Lukas Schüßler Mar 28 '16 at 16:04
  • $\begingroup$ Sign-enc-mac could work, provided you want to distribute a secret key to the third party. $\endgroup$ – Maarten Bodewes Mar 28 '16 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.