In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt:

Consider an implementation of this protocol, with the additional feature of 
confirmation messages. Whenever Bob receives a message, he returns it as a 
confirmation of receipt.

1. Alice signs a message with her private key, encrypts it with Bob’s public key, 
and sends it to Bob. 


2. Bob decrypts the message with his private key and verifies the signature with 
Alice’s public key, thereby verifying that Alice signed the message and 
recovering the message. 

VA(DB(EB(SA(M)))) = M

3. Bob signs the message with his private key, encrypts it with Alice’s public 
key, and sends it back to Alice. 


4. Alice decrypts the message with her private key and verifies the signature 
with Bob’s public key. If the resultant message is the same one she sent to Bob, 
she knows that Bob received the message accurately. 

Assume that Mallory is a legitimate system user with his own public and private 
key. Now, let’s watch as he reads Bob’s mail. First, he records Alice’s message to
Bob in step (1). Then, at some later time, he sends that message to Bob, claiming
that it came from him (Mallory). Bob thinks that it is a legitimate message from
Mallory, so he decrypts the message with his private key and then tries to verify
Mallory’s signature by decrypting it with Mallory’s public key. The resultant
message, which is pure gibberish, is:

EM(DB(EB(DA(M)))) = EM(DA(M)) [1]

Even so, Bob goes on with the protocol and sends Mallory a receipt:

EM(DB(EM(DA(M)))) [2]

Now, all Mallory has to do is decrypt the message with his private key, encrypt it
with Bob’s public key, decrypt it again with his private key, and encrypt it with
Alice’s public key. Voilà! Mallory has M.

The message that Mallory recorded is: EB(SA(M))

But why the DA in formula [1] and [2]

I think if Mallory want to 'steal' the origin message M, he should do the following steps:

  1. Mallory receive the encrypted message as a confirmation of receipt from Bob : EM(SB(VM(DB(EB(SA(M)))))) = EM(SB(VM(SA(M)))) = X
  2. Then Mallory have to decrypt X with his private key : DM(X) = SB(VM(SA(M))) = X1
  3. And then verifies X1 with Bob's public key : VB(X1) = VM(SA(M)) = X2
  4. And then encrypt X2 with his private key EM(X2) = SA(M) = X3
  5. finally, verifies X3 with Alice's public key VA(SA(M)) = M

Can any one point out my mistake?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.