2
$\begingroup$

I'm doing some tests in Java, encrypting messages exchanged between two entities. I'm using a symmetric key to encrypt the messages.

Right now I've stumbled upon a question. Is it enough to encrypt then sign when using symmetric-key encryption? The signature process is based on an asymmetric key pair. I think that by encrypting the message the content will be hidden and then if I sign it it will be authenticated but I feel like something is off. I'd like to hear someone else's opinion on this topic since I'm nothing but a beginner trying to learn.

Improve this question
$\endgroup$

2 Answers 2

Reset to default
1
$\begingroup$

I think that by encrypting the message the content will be hidden; and then if I sign it, it will be authenticated

  • Content is hidden from adversaries not knowing the symmetric key.
  • Origin of the ciphertext is authenticated, and verifiable by any third party.
  • Origin of the plaintext is not authenticated, much less verifiable by a third party, unless we add hypothesis
    1. Whoever needs to authenticate the plaintext knows the symmetric secret key
    2. and it is assumed the integrity of the symmetric secret key used by both
      • the sender/signer
      • and whoever needs to authenticate the plaintext.

What could happen is that an adversary (or accident, poor practice) manages to garble or de-synchronize the symmetric secret key used by sender or receiver/verifier. If the encryption is with e.g. AES-CTR, the receiver will end with an incorrect but trusted plaintext. In many contexts that's an effective denial of service; in some others, a successful attack.

These issues are solved by signing, appending signature, then encrypting (critically, the signature must be encrypted). An important advantage is that a third party can authenticate the message after decryption without needing to be given the symmetric key.

Note: using authenticated encryption in the original scheme tends to remove requirement 2 in practice, but does not in theory: authenticated encryption formally assumes integrity of the symmetric key on the receiver side. An authenticated encryption scheme would arguably still be considered secure if it was feasible to exhibit a key that allows verification of a message produced under a different key, and which deciphers differently with the exhibited key than it does with the original.

Improve this answer
$\endgroup$
1
$\begingroup$

Well, it would depend somewhat on what your security goals are, but signing the message would enable the receiver to verify integrity: that the ciphertext that it got is precisely the ciphertext that the sender sent (at some point; you still may need to worry about replay).

However, you're assuming that you have a shared symmetric key to encrypt; is there a specific reason you don't use that to also perform integrity (either by using a combined mode operation, such as AES-GCM, or generating a Message Authentication Code using other key bits that you shared). The one thing that using a signature buys you is the ability to prove to a third party that the message is authentic (and not something the receiver made up); is that important to you?

Improve this answer
$\endgroup$
4
  • $\begingroup$ I want to guarantee integrity and authentication of the messages exchanged. What would be the difference in using GCM or a MAC? $\endgroup$
    – user6057404
    Commented Jan 2, 2018 at 16:51
  • $\begingroup$ The differences would be a) GCM/MAC is a lot more efficient (both in computation and message size), and b) GCM/MAC will allow the receiver the verify that he received the message properly, but he won't be able to prove it to someone else (as he could generate that message; while with a signature, he cannot generate that without the signature private key) $\endgroup$
    – poncho
    Commented Jan 2, 2018 at 18:10
  • $\begingroup$ I see the difference now, thank you. In my case I wouldn't have to prove to anyone but the receiver that the message was sent by person X. So I think the signature might just be it. The message is signed and then I encrypt it. Would you recommend something else, like signing again? In all my ignorance, I'd also like to ask you, isn't a signed message easy to unsign and resign with another person's private key since you can actually just grab the plain text? $\endgroup$
    – user6057404
    Commented Jan 3, 2018 at 12:15
  • $\begingroup$ It may be worth emphasizing that signing the message enables not just the receiver but anyone with the sender's public key to verify identity. This can be bad for deniability — and for mistaken identity in forwarding: world.std.com/~dtd/sign_encrypt/sign_encrypt7.html $\endgroup$
    – Squeamish Ossifrage
    Commented Mar 4, 2018 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.