Reading Cryptography And Network Security Principles And Practices 6th Edition by William Stallings, I came across the following excerpt on digital signature that got me confused:

A -> B: M || E(PRa, H(M))

This method guarantees that A cannot later deny having sent the message. However, this technique is open to another kind of fraud. Bob composes a message to his boss Alice that contains an idea that will save the company money. He appends his digital signature and sends it into the e-mail system. Eventually, the message will get delivered to Alice’s mailbox. But suppose that Max has heard of Bob’s idea and gains access to the mail queue before delivery. He finds Bob’s message, strips off his signature, appends his, and requeues the message to be delivered to Alice. Max gets credit for Bob’s idea. To counter such a scheme, both the message and signature can be encrypted with the recipient’s public key:

A -> B: E(PUb, [M || E(PRa, H(M))])


  • A -> B: A is the sender (Bob), B is the recipient (Alice)
  • M = Message
  • E = Encryption function
  • PRa = A's private key
  • H = Hash function
  • PUb = B's public key

My understanding of digital signature is that by decrypting with Bob's public key, Alice already knows that it was signed by Bob (provided Alice is guaranteed to have Bob's real public key, which is not discussed in this excerpt). So if Max replaces Bob's signature, Alice will be alerted already that the signature was forged. Encrypting the whole message as in the final solution does not add anything to the integrity of the signature, it only prevents from eavesdropping, right ?


First of all, the fact that A is Bob and Alice is B is a bit confusing.

In my explanation:

  • A - Alice (receiver), has keys PRa, PUa

  • B - Bob (sender), has keys PRb, PUb

The former approach has a couple of substantial drawbacks:

  • The message is send in a plain text. Any one who has an access to a communication channel can read its content.

  • The signature of a message hash is separated from the actual message. They are only concatenated together and as the signature has a fixed size it can be easily stripped from a content.

The first drawback allows Max to read a content and decide that he wants to commit a forgery as it makes sense for his agenda.

The second drawback actually allows him to forge the email. He can easily calculate H(M). Assuming Max knows Bob's public key he can strip of the H(M) "verifying" the signature with Bob's public key.

Then Max simply signs the H(M) with his private key (PRm) and substitutes block E(PRa, H(M)) with E(PRm, H(M)).

The result would be that the message looks like sent by Max as it's signed by his private key and nobody can detect that it was originally an idea of Bob.

The later approach with encrypting both content and a signature with Alice's public key guarantees that only Alice would be able to decrypt the whole packet (thus content + signature).

Max won't be able to substitute the signature with his own as he doesn't knows PUa. Neither M, nor H(M) is possible to recover for him.

When Alice would receive the message it would decrypt it with her own private key (PRa) and then verify the signature with Bob's public key (PUb) thus being sure that the message was indeed send by Bob.

This pattern would still lack integrity check but generally it's much better then the former one.

  • $\begingroup$ I think I got confused from the mix between theory and practice of the author's example. In practice, I expect the recipient's email program to have matched the sender's address with the sender's public key already when verifying the signature, thus detecting the forgery anyway (Max's public key would not ever be considered by it). But in theory as you clarified, if the email program can be routed somehow towards using Max's public key, then the forgery succeeds. $\endgroup$
    – fabmlk
    Mar 28 '17 at 21:12
  • $\begingroup$ I think it would not be a problem for Max to spoof a sender field of an email also. And yes, the example with emails is not the best way to explain these issues as it's tied also to a structure of an email packet which is not mentioned anyhow. $\endgroup$
    – ddnomad
    Mar 28 '17 at 21:14
  • $\begingroup$ @fabmlk if you find my answer good enough, please mark it as accepted (though you can wait for other answers if any and choose the best one). $\endgroup$
    – ddnomad
    Mar 28 '17 at 21:47
  • $\begingroup$ of course, I always wait a little just in case $\endgroup$
    – fabmlk
    Mar 29 '17 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.