# Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question:

Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $\Pi_s=(\mathcal{K}_s,\mathrm{sign},\mathrm{verify})$, and you are asked to define a new primitive $\overline{\Pi}=(\overline{\overline{\mathcal{K}}},\overline{\mathcal{E}},\overline{\mathcal{D}})$ that achieves both privacy and authenticity. How would you do it? Give at least one construction and a convincing informal argument of security. Discuss any operational/implementation issues that might arise if you want to support “large” plaintexts, and how you would address them in your construction.

As a second part, what if you want to expand the API for $\overline{\Pi}$ to accomodate associated data? How would you modify your construction(s)? Keep in mind that associated data is “context” information that does not require privacy protection but does require authenticity protection.

I'm working on a solution to the first part using CTR mode, because it seems to achieve the requirements well, especially with supporting large plaintexts. Does this seem like a reasonable approach?

Also, I'm having an issue coming up with an answer to part two. Can CTR mode support associated data? If not, is there a better way to go about this?

• Using CTR isn't the answer they'll looking for (for one, it isn't a public-key encryption/signature scheme, which is what they're asking for). Instead, how would you use $\mathcal{K}_e$ and $\mathcal{K}_s$ within your new primitive? – poncho Apr 18 '16 at 1:45
• I couldn't do your assigned work but simply want to say that I have written a code that employs RSA to do encryption on plaintexts directly and with integrity check as well as signature of the sender. See Ex. 3S of Appendix in s13.zetaboards.com/Crypto/topic/7234475/1/ – Mok-Kong Shen Apr 18 '16 at 11:51