# How “Resending Message Attack” works?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt:

Consider an implementation of this protocol, with the additional feature of
confirmation messages. Whenever Bob receives a message, he returns it as a
confirmation of receipt.

1. Alice signs a message with her private key, encrypts it with Bob’s public key,
and sends it to Bob.


EB(SA(M))

2. Bob decrypts the message with his private key and verifies the signature with
Alice’s public key, thereby verifying that Alice signed the message and
recovering the message.


VA(DB(EB(SA(M)))) = M

3. Bob signs the message with his private key, encrypts it with Alice’s public
key, and sends it back to Alice.


EA(SB(M))

4. Alice decrypts the message with her private key and verifies the signature
with Bob’s public key. If the resultant message is the same one she sent to Bob,
she knows that Bob received the message accurately.

Assume that Mallory is a legitimate system user with his own public and private
key. Now, let’s watch as he reads Bob’s mail. First, he records Alice’s message to
Bob in step (1). Then, at some later time, he sends that message to Bob, claiming
that it came from him (Mallory). Bob thinks that it is a legitimate message from
Mallory, so he decrypts the message with his private key and then tries to verify
Mallory’s signature by decrypting it with Mallory’s public key. The resultant
message, which is pure gibberish, is:


EM(DB(EB(DA(M)))) = EM(DA(M)) [1]

Even so, Bob goes on with the protocol and sends Mallory a receipt:


EM(DB(EM(DA(M)))) [2]

Now, all Mallory has to do is decrypt the message with his private key, encrypt it
with Bob’s public key, decrypt it again with his private key, and encrypt it with
Alice’s public key. Voilà! Mallory has M.


The message that Mallory recorded is: EB(SA(M))

But why the DA in formula [1] and [2]

I think if Mallory want to 'steal' the origin message M, he should do the following steps:

1. Mallory receive the encrypted message as a confirmation of receipt from Bob : EM(SB(VM(DB(EB(SA(M)))))) = EM(SB(VM(SA(M)))) = X
2. Then Mallory have to decrypt X with his private key : DM(X) = SB(VM(SA(M))) = X1
3. And then verifies X1 with Bob's public key : VB(X1) = VM(SA(M)) = X2
4. And then encrypt X2 with his private key EM(X2) = SA(M) = X3
5. finally, verifies X3 with Alice's public key VA(SA(M)) = M

Can any one point out my mistake?

• As indicated by the (rather late) answer, there is no mistake, it's about terminology and the equivalence of operations. This also means that there is no problem if secure constructions (RSA with padding) or separate key pairs are used. – Maarten Bodewes Aug 27 '19 at 15:11

I think what Bruce has done is to use Sign and Decrypt interchangeably, he has done same for Validate and Encrypt. I think it is because - to sign a message - Alice uses her private key. Now in terms of encryption / decryption, a private key is used to decrypt the message and a public key is used to encrypt the message.

Vm(Db(Eb(Sa(M)))) = Vm(Sa(M))


he is saying:

Em(Db(Eb(Da(M)))) = Em(Da(M))


Which I believe is same thing on implementation level.

So OP is correct, author has used different terms without specifying they are same. This is mentioned it in the next paragraph.

• Hi adi and thanks for answering. Please try to format your answers and questions to the best of your ability. I had to make a lot of changes to the text to make it acceptable to our site. If you simply stop typing at the final sentence and use the word "para" rather than "paragraph" then this goes beyond just a problem with a language barrier. Meaningful answers - such as this one - are worthy of being backed by meaningful formatting. – Maarten Bodewes Aug 27 '19 at 15:10