The goal, the method, and the interface of the signcrypt primitive.

Question

Some time ago, I proposed making the site more educational by teaching correct cryptographic programming. The proposal had had somewhat good reception, but was met with cold ice as there had been little new questions on this topic.

Therefore today I'd like to ask a question centralize the idea behind the correct programmatic usage of the signcrypt (Sign and Encrypt) primitive.

The goal of signcrypt in its simple form can be stated as: to ensure the confidentiality of a non-repudiatable, authentic, integral message for its intended recipiant (correct me if I've mis-stated it). From this, I have the following questions at hand:

1. Per this recent question, should we a) query the signing oracle on the encrypted message, or b) query the encryption oracle on the signed message?

2. What is the interface of signcryption? What functions does the tuple consist of?

3. As it deserves a topic of its own, in short summary how does signcryption fit into the big picture of instant messaging protocol like the Double Ratchet Algorithm?

Answer 1

1. Order of signing and encrypting.

It is often done in authenticated encryption to Encrypt-Then-MAC. However, there's a bit of problem with Encrypt-Then-Sign here as mentioned by the linked answer in the linked question. So it's better to sign-then-encrypt unless we have a more dedicated signcrypt algorithm.

2. The Interface.

The tuple generally consist of the following functions:

$\operatorname{GenSign}(\langle \text{entropy source}\rangle) \to (\text{key}_\text{sign}, \text{key}_\text{verify})$

$\operatorname{GenEnc}(\langle \text{entropy source}\rangle) \to (\text{key}_\text{enc}, \text{key}_\text{dec})$

$\operatorname{SignEnc}(\text{msg}, \text{key}_\text{sign}, \text{key}_\text{enc}) \to \text{ciphertext}$

$\operatorname{VerifyDec}(\text{ciphertext}, \text{key}_\text{verify}, \text{key}_\text{dec}) \to \text{msg}$ or $\text{FAIL}$

3. Instant Messaging Protocol.

The double ratchet "instant messaging" protocol had already solved the confidentiality problem from two ends: forward secrecy and future secrecy. So it's only needed to sign the message in such framework.