My reading of RFC 5652 Authenticated-Data does not give receiver confidence in originator of message, and therefore can not provide data integrity certainty.
Originator process is:
1. generate random message key 2. encrypt message key for (each) receiver 3. generate message MAC using message key 4. send to receiver
Why can't an attacker do this?
1. intercept message 2. modify message (since it is not encrypted) 3. generate a new random message key 4. encrypt message key for receiver using receiver public key 5. generate a new MAC 6. send to receiver
How would receiver know that it was not from originator? How would receiver know that message has been changed?