May I know what could be some advantages and disadvantages of doing the below in an asymmetric crypto process. What could be some of its primary and common uses?

Produce a digital signature on the plaintext, encrypt both plaintext and digital signature, and then produce another digital signature on the ciphertext

  • $\begingroup$ The inner signature is there to ensure authenticity to the recipient. I could imagine, the clients which communicate doing the inner signature and the server doing the outer to assure the username-data binding and / or sort out by itself which cipher texts have been added the correct way. $\endgroup$ – SEJPM Feb 11 '17 at 18:11
  • $\begingroup$ I have designed a scheme to do signed encryption with RSA, see Ex. 3S in s13.zetaboards.com/Crypto/topic/7234475/1/ $\endgroup$ – Mok-Kong Shen Feb 12 '17 at 9:46
  • $\begingroup$ [Addition to my previous comment:] My software, properly maintained by myself, is now only available at: mokkong-shen.homepage.t-online.de $\endgroup$ – Mok-Kong Shen Apr 13 '17 at 12:42

The outer signature protects the ciphertext against change. If the signature is verified before decryption then the signature can for instance protect the ciphertext against padding oracle attacks, both on the asymmetric encryption as well as the symmetric encryption that is commonly within a hybrid cryptosystem.

The encryption of the plaintext and inner signature of course offers confidentiality of the message (see the last section why the signature itself also needs to be encrypted).

The inner signature protects the integrity of the message after decryption. Obviously the outer signature (over the ciphertext) cannot be used on the plaintext message.

So you would either have to store the ciphertext (which means you'd have to decrypt the message with your private key each time to view the verified contents) or you would loose the ability to verify the plaintext message.

However, if you sign the plaintext message as well then you can still verify the message using the sender's public key even after decryption.

Note that encrypting the inner signature prevents an attacker of retrieving information about the plaintext. If it was directly available then the attacker could verify hashes over possible plaintext using the public key of the sender.

For instance, an attacker could verify that the message is "Yes" or "No" by guessing either message and then verifying the signature.

| improve this answer | |

This falls into the anti-pattern "Mac-Then-Encrypt" but you are adding "Encrypt-then-Mac" to the output of first anti-pattern. It's tough to say but since you are encapsulating the first anti-pattern within the EtM pattern you could be good. But error conditions are multiple in this case: 1. What happens when the outer MAC is found to be incorrect 2. What happens when the inner MAC is found to be incorrect 3. The time it takes to give someone a result of error in #1 and #2 above

You could potentially do it correctly but it all comes down to the implementation. My recommendation is use standard authenticated encryption with associated data (AEAD) methods but again I'm not a cryptographer: https://en.wikipedia.org/wiki/Authenticated_encryption

| improve this answer | |
  • $\begingroup$ What the f... is a "anti-pattern"? $\endgroup$ – user27950 Feb 11 '17 at 21:12
  • $\begingroup$ Anti-pattern is a family of vulnerabilities that indicate a commonly occurring undesired set of conditions. en.wikipedia.org/wiki/Anti-pattern $\endgroup$ – tr4nc3 Mar 11 '17 at 23:03
  • 1
    $\begingroup$ MAC is not an asymmetric process. $\endgroup$ – Maarten Bodewes Apr 12 '17 at 22:30
  • $\begingroup$ Agreed that it's not, but if you review the question, the seeker was talking about Digital Signatures which is an asymmetric process. $\endgroup$ – tr4nc3 Apr 15 '17 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.