0
$\begingroup$

If a sender creates a hash H of message M and encrypts it using receiver's public key, what do we ensure of the above three at the receiver's end.

PS : I know this is not the right way to send messages but I'm just trying to learn how do things work in such cases.

$\endgroup$
2
$\begingroup$

You're sending a message without signing it, and without any element which can reliably identify you as the sender, so you're clearly subject to Man in the Middle (MitM) attack. An attacker can intercept your message and replace it by his, he only has to compute a hash, and encrypt it with the receiver public key.

The only thing is guarantied is the secrecy of your message, but the hashing was useless. Signing your message would have been a good solution since it implies a secret shared by the two parties. An even better option would have been to use an authenticated encryption with associated data (AEAD) such as AES-GCM since it take care both of encryption and authentication, and asymmetric crypto is mostly use for signature and key exchange but not data encryption (I know it's not your point, but I had to say it ;-) ).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.