Let's say two users (U1, U2) each have a private key they keep to themselves, and each broadcast a corresponding public key to the world.

Let's then say that U1 wants to send a signed encrypted message to U2. I understand the idea that U1 wants to encrypt the message using his own private key, so that U2 can have proof that the message indeed came from U1 (since if U1's public key can decrypt a msg, it must've been encrypted by U1), and also U2's public key, so that only U2 can decrypt the message using his private key.

What I'm not completely clear on are the differences between first encrypting with U1's private key and then U2's public key, or in the opposiste order.

The way I see it, in the first possible order (U1 private, then U2 public), nothing can be gleaned from the doubly encrypted message by observers, even if they have both U1 and U2's public keys.

If U1 were to doubly encrypt the message in the opposite order (using U2's public key first and then U1's private key), the only difference would be that observers would be able to break the layer of U1's encryption (using his public key) and see that he sent a message (but not to whom, or at least not from decrypting that first layer). Nothing more could be observed because the decrypted message (using U1's public key) would just reveal another layer of encryption that only U2's private key could decrypt.

Is that correct? Does order matter other than that?

  • 3
    $\begingroup$ Possible duplicate of Should we sign-then-encrypt, or encrypt-then-sign?. If the answers don't satisfy you let us know. $\endgroup$ – kelalaka Apr 28 '19 at 8:28
  • $\begingroup$ As stated, this question seems to me to be a duplicate of the previous one. But I think there is a reasonable variation on the question: What is the appropriate security notion for the composition of signature and encryption, what security do generic compositions attain, and what literature is there on the subject? There's also a related notion: public-key authenticated encryption, which is more likely to be what you actually want—signature implies third-party verifiability, which may run counter to your goals. $\endgroup$ – Squeamish Ossifrage Apr 28 '19 at 15:46