I have a scenario where entity $A$ has an unauthentic copy of the public key $P_B$ of $B$ and an authentic copy of $P_C$ of $C$, trusted by both $A$ and $B$.

Now $A$ wants to establish trust in $P_B$.


  1. $B$ writes a message, signs it and sends it to $C$ : $$B \rightarrow C: M \| S_B(M)$$

  2. $C$ is an intermediary entity and forwards the message to $A$ : $$C \rightarrow A : M \| S_B(M) \| S_C(M \| S_B(M))$$

  3. $A$ then validates $S_C(S_B(M))$ and $S_B(M)$ successfully

Can $A$ now trust the authenticity of $P_B$ because the signature $S_B(M)$ was received in an authentic manner?

The practical example is DKIM in E-Mail infrastructure:

  • sender may sign her outgoing message (e.g. using PGP);
  • does not attach public key to not annoy non-PGP enabled receivers;
  • the message including the signature gets signed by the providers DKIM key;
  • the receiver gets a copy of the sender PK and wants to establish some trust beyond TOFU.

1 Answer 1


I think this depends heavily on the expectations and trust that A has with respect to C. $A$ should be safe to now view $P_B$ as authentic provided that $A$ trusts that:

  1. $C$ will only sign $B$'s message if it could successfully verify $S_B(M)$
  2. $C$ would only use $P_B$ if it had previously obtained and verified the authenticity of $P_B$
  3. $C$'s requirements for verifying the authenticity of $P_B$ are at least as strict as $A$'s

Note that this is essentially the same as with certificate authorities, where $P_x$ are X.509 certificates (e.g. $P_C$ is the root certificate for a CA, $C$). $B$ can't expect to provide $P_B$ to everyone it expects to communicate with so instead it establishes trust with $C$ which then signs $P_B$. When $A$ receives data from $B$, it would first receive $P_B || S_C(P_B)$ then $M || S_B(M)$. $A$ then decides to trust $P_B$ on the grounds that $C$ would not have signed $P_B$ without first establishing it's authenticity. $A$ then, in turn, trusts that $M$, in fact, originated from $B$.

However, it's important to note the $A$ having authenticated $P_C$ is not sufficient. Messages signed with $S_C$ may, in fact, be coming from $C$ but that does not mean that $C$ is fully trustworthy. For $A$ to trust $C$'s trust of $P_B$, $A$ must also trust that $C$ is sufficiently cautious about establishing the authenticity of $P_B$. Just as it would be extremely concerning if a trusted certificate authority were to start signing any certificate sent their way, $A$'s confidence in the authenticity of $M$ and $P_B$ must not be greater than $A$'s confidence in $C$'s process of establishing trust.

Similarly, if $C$ viewed its job simply as marking that it received and relayed the message, blindly signing the entire payload it received, $A$ would be mistakenly assuming an assurance not actually provided by $C$.

Long story short: $A$ can only trust $P_B$ if it trusts that $C$ is, and is sufficiently capable of, guaranteeing the authenticity of $P_B$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.