Using ECIES in a file encryption protocol, I need to authenticate the sender, so I'm using ECDSA, and I'm wondering if signing the ephemeral public key(needed by receiver to derive the shared symmetric key) is the way to go? The goal is to prevent MitM from forging and sending a fake ephemeral public key. The code(C#) uses Inferno but it is easy to follow considering the explicit variable names and the comments:

    internal static void Encrypt(CngKey receiverPublicDhm, CngKey senderDsa, string file, string text)
        var plainTextBytes = text.ToBytes();                         

        var ephemeralBundle = receiverPublicDhm.GetSharedEphemeralDhmSecret();
        var ephemeralPublic = ephemeralBundle.EphemeralDhmPublicKeyBlob;
        var sharedSymmetric = ephemeralBundle.SharedSecret;

        // sign emphemeral public blob and plainText(so that MitM cannot forge a fake ephemeral public key)
        var toSign = Utils.Combine(ephemeralPublic, plainTextBytes);
        byte[] signed;
        using (var ecdsa = new ECDsaCng(senderDsa) { HashAlgorithm = CngAlgorithm.Sha384 })
            signed = ecdsa.SignData(toSign);

        // ETM signature and plaintext
        var toEncrypt = Utils.Combine(signed, plainTextBytes);
        var encrypted = SuiteB.Encrypt(sharedSymmetric, toEncrypt.AsArraySegment());

        using (var fs = new FileStream(file, FileMode.Create, FileAccess.Write))
            // so the format is:
            // [ephemeral public] (signed but not encrypted)
            // [signature] [ciphertext] (both encrypted and MAC'd)
            fs.Write(ephemeralPublic, 0, ephemeralPublic.Length);
            fs.Write(encrypted, 0, encrypted.Length);                                                       

Edited: Fixed a typo in file format description

  • $\begingroup$ @Maarten Bodewes: You are right, sorry about the typo, edited and fixed. How should I have described the protocol I'm using? $\endgroup$ – Frank Dec 29 '16 at 0:51
  • 1
    $\begingroup$ I guess you have an answer now, so that's all right. We try to use mathematical descriptions to describe protocols, using e.g. $\operatorname{H}$ for hashing, $\operatorname{E}$ for encryption etc. Then we define which primitive we use for - for instance - $\operatorname{E}$. But I guess this takes some reading of cryptographic papers. Pseudo code can also be used, in that case leave out things like streaming and try not to use things like SuiteB.Encrypt which doesn't really tell us too much. $\endgroup$ – Maarten Bodewes Dec 29 '16 at 10:17
  • $\begingroup$ @Maarten Bodewes: Okay thanks for the precision, I'll consider this in my future posts. $\endgroup$ – Frank Dec 29 '16 at 20:52

I disagree with Maarten Bodewes answer for your specific scenario/code:

  1. Your ECDSA signing code does not leak information about the plaintext. However, even if it did, the signature and plaintext are Inferno-encrypted (ie. no affected by MiTM). In order to get to the ECDSA signature, one needs to decrypt first (ie. the plaintext is revealed on decryption anyway).

  2. Your code is not signing ECDH public key. It is signing the hash over [ephemeral public key]+[plaintext]. And the resulting signature is Inferno-encrypted (safe against MiTM) and safe against recipient-tampering.

I believe there is nothing wrong with the approach you are taking. I offer no comments on your file format/code.

  • $\begingroup$ A thousand thanks for your guidance. Looks like the file format and "a few" more things need some improvements. About every article I can find deal with client/server/database files, I have a hard time finding infos applying to my scenario... $\endgroup$ – Frank Dec 29 '16 at 1:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.