3
$\begingroup$

My reading of RFC 5652 Authenticated-Data does not give receiver confidence in originator of message, and therefore can not provide data integrity certainty.

Originator process is:

1. generate random message key
2. encrypt message key for (each) receiver
3. generate message MAC using message key
4. send to receiver

Why can't an attacker do this?

1. intercept message
2. modify message (since it is not encrypted)
3. generate a new random message key
4. encrypt message key for receiver using receiver public key
5. generate a new MAC
6. send to receiver

How would receiver know that it was not from originator? How would receiver know that message has been changed?

$\endgroup$
2
$\begingroup$

How would receiver know that it was not from originator?

The recipient doesn't know the sender with this scheme. It can be anybody.
Why? There's no secret involved in the sending process that is unique to the sender and thus anybody can create such a message, as you already noted.

Why can't an attacker do this?

He can. However this looks more like a building-block for other schemes and as such these may implement advanced sender-authentication mechanisms which would prevent such an attack.

How would receiver know that message has been changed?

The recipient always knows that the message is unaltered with respect to the sender, because the MAC is valid. The fact that the sender may change is not covered with this scheme (and in fact, an attacker does change the sender to himself with the obvious attack).

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.