2
$\begingroup$

I'm sure this has been asked before. Its just too blindingly obvious.

from wikipedia

"Digital signatures, in which a message is signed with the sender's private key and can be verified by anyone who has access to the sender's public key."

So lets say Bob sends Alice an unencrypted message, and Charlie overhears it. What's to stop Charlie from signing his own messages with that private key and henceforth having the ability to impersonate Bob?

So is there a point to digitally signing some message that isn't also encrypted? Or are all communications using digital signatures also encrypted? Wikipedia made it seem like there were two independent ideas, but I can't see a use case for signing-without-encrypting, where I can for encrypting-without-signing and encrypting-and-signing.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

So lets say Bob sends Alice an unencrypted message, and Charlie overhears it. What's to stop Charlie from signing his own messages with that private key and henceforth having the ability to impersonate Bob?

Alice already possesses Bob's public key $\text{pub}_{B}$, and Bob is the only one that has access to the corresponding private key, $\text{priv}_{B}$.

The private key is not shared with anyone, while the public key can be published.

Bob can use $\text{priv}_{B}$ to perform the sign procedure which creates a signature $s$ from a message $m$.

Then Alice acquires $s, m$ and can use them with $\text{pub}_{B}$ to perform the verify procedure, which only outputs $1$ if $s$ was created using $m, \text{priv}_{B}$.

Charlie does not have $\text{priv}_{Bob}$, and so he cannot create a value $s$ for any $m$ that will pass the verify procedure that Alice will perform. (At least, he cannot do so with non-negligible probability, assuming that the signature scheme is secure).

So is there a point to digitally signing some message that isn't also encrypted?

Yes

Or are all communications using digital signatures also encrypted?

No

Wikipedia made it seem like there were two independent ideas

They are two independent ideas.

Digital signatures provide authenticity and integrity of the signed message - if the signature verifies correctly, then you know that the message came from Bob and was not tampered with.

Encryption provides confidentiality, which means that unauthorized parties cannot learn the contents of the message.

but I can't see a use case for signing-without-encrypting, where I can for encrypting-without-signing and encrypting-and-signing.

There are plenty of use cases for signatures without encryption.

Exchanging public keys for public-key encryption or key agreement is one of the most important examples (e.g. Public key Infrastructure).

Improve this answer
$\endgroup$
7
  • $\begingroup$ @user1733212 In the example above, $m$ is an arbitrary string of bits and so it does not matter if it is a plaintext or ciphertext. $s$ is not an encryption of $m$, many sources falsely claim that digital signatures are "encrypting with the private key and decrypting with the public key", which is only even vaguely close to true for RSA, and not even close to true with basically all other signature schemes ever. A signature is not an encrypted message, remember from the definition above that encryption preserves confidentiality and both $s, m$ are public knowledge. $\endgroup$
    – Ella Rose
    Nov 6, 2018 at 2:48
  • $\begingroup$ Sorry, I clicked submit before I finished. Not sure what you think I think. This is what I meant to type after your first post ...................................ok. So the key itself is not included... rather, a piece of the message that has a pre-established text is encrypted with the private key, and if you can decrypt it to that pre-established text using the public key of the person who claims to have sent it, then you know the message is legit. $\endgroup$
    – user1733212
    Nov 6, 2018 at 2:56
  • $\begingroup$ Here's a followup.... how does it verify message integrity? If my message gets changed in transit, either because charlie is a jerk, or because my wire got zapped by some cosmic radiation, that wouldn't be defended against in my scheme. Is there something like a checksum also embedded in the signature? $\endgroup$
    – user1733212
    Nov 6, 2018 at 3:01
  • $\begingroup$ @user1733212 As stated in my comment to you, "encrypted with the private key" and "decrypted with the public key" is not at all accurate, a signature is something wholly and completely different. For example, you can construct signatures based off of Diffie-Hellman, which is not public-key encryption. There is no pre-established text included either, the answer above outlines what information needs to be pre-established and what can be sent over the wire. 1/2 $\endgroup$
    – Ella Rose
    Nov 6, 2018 at 15:28
  • $\begingroup$ 2/2: The specifics of how the verification routine works are particular to the signature scheme that is being used (of which there are many). Remember (from the answer) that the verify routine outputs $1$ if and only if $\text{pub}_{B}, m, s$ are supplied as inputs to the routine. If $m$ is modified, then the value supplied to the verify routine is no longer $m$ but $m'$ - some other $m$, and hence the verify procedure will not output $1$ when supplied $\text{pub}_{B}, m', s$. The signature is a "checksum" of sorts, albeit a cryptographic one. $\endgroup$
    – Ella Rose
    Nov 6, 2018 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.