3
$\begingroup$

I saw this exercise for evaluating the security(confidentiality, integrity, authenticity, and non-repudiation) of some schemes:

  1. ENC(M) || SignA(ENC(M))
  2. ENC(M || SignA(M))
  3. SignA(ENC(M))
  4. ENC(M) || SignA(M)

Where || is concatenation and ENC (is encryption on secure shared key) and SIgnA is RSA Signature of Alice.

My answer is :

  1. Have confidentiality (from ENC), and authenticity from signature, but no integrity because i have the signature of ENC (so someone can use forgery on my signature) and non-reputation i don't think (but i m not sure).

  2. This have all property, because ENC give confidentiality, signature authenticity e non repudation and integrity because i have message and his signature for verify.

  3. In this schema i have confidentiality and authenticity , but no integrity. I m not sure about non-repudation.

  4. With this schema i have confidentiality, integrity and authenticity. I have again doubt about non-repudation.

I m not so clear if autenticity implies non-repudation (using signature).

Anyone can help me on this stuff?

$\endgroup$
  • $\begingroup$ Wasn't this in Crypto I or another coursera crypto course? $\endgroup$ – Maarten Bodewes Feb 8 at 16:34
  • 1
    $\begingroup$ ENC(M) || SignA(ENC(M))is a tad ambiguous. We have to assume that ENC(M) is the same in both occurrences, which is not that certain since ENC is not a function in ENC(M). Rather, ENC(M) is a shortcut for: draw a random R and compute ENC(R,M), where this time ENC is a function. $\endgroup$ – fgrieu Feb 8 at 17:50
  • $\begingroup$ @MaartenBodewes maybe, I take from my professor slides :\ $\endgroup$ – theantomc Feb 8 at 17:56
  • $\begingroup$ @fgrieu from question " Enc(x) means symmetric encryption of x" $\endgroup$ – theantomc Feb 8 at 17:57
  • 1
    $\begingroup$ ENC being symmetric does not imply that ENC is a function. In fact, it can't be, if the encryption is CPA-secure. In Symmetric encryption, there typically is a random Initialization Vector drawn at each invocation. $\endgroup$ – fgrieu Feb 8 at 18:21
3
$\begingroup$
  1. ENC(M) || SignA(ENC(M))
    Have confidentiality (from ENC), and authenticity from signature, but no integrity because i have the signature of ENC (so someone can use forgery on my signature) and non-reputation i don't think (but i m not sure).

Confidentiality is yes because of ENC, correct.

The other's are all linked to each other. They are present if the receiver only accepts signed messages and the verification is performed with the trusted public key of Alice. If a public key of an adversary is accepted then any random ciphertext can be created and signed.

Non-repudiation is not accomplished because the secret key is not signed together with the message. If the receiver uses a different key you'd get a different message after decryption, even though the signature over the ciphertext verifies. So it is NO for non-repudiation and YES for confidentiality and message integrity / authenticity.

  1. ENC(M || SignA(M))
    This have all property, because ENC give confidentiality, signature authenticity e non repudation and integrity because i have message and his signature for verify.

But yes, basically right. Note that if the encryption scheme is vulnerable against e.g. plaintext / padding oracle attacks that the confidentiality breaks down. This scheme is what we usually do.

  1. SignA(ENC(M))
    In this schema i have confidentiality and authenticity , but no integrity. I m not sure about non-repudation.

The message is not send (!), so it is kept very confidential. You cannot even guess it, because the signature is over encrypted data. Integrity / authenticity are then of course nonsense. Non-repudiation is also not possible.

Unless somebody is able to get the original message and encrypt it again anyway. But usually only the given message are allowed (or you'd have issues with DoS and replay attacks and whatnot).

  1. ENC(M) || SignA(M)
    With this schema i have confidentiality, integrity and authenticity. I have again doubt about non-repudation.

Wrong! You can guess the data and verify the signature. If it verifies, you've found the data. We commonly assume that the public key is known to all.

Once you've decrypted you have M, SignA(M) so there is your non-repudiation - and therefore integrity & authenticity.

Again: if the encryption scheme is vulnerable against e.g. plaintext / padding oracle attacks that the confidentiality breaks down (even more significantly for complex messages).


Beware that generally these kind of questions are debated for "perfect" schemes, where E is perfect cipher and SignA cannot be broken. Furthermore, no other communication or actions are allowed other than the one specified.

I've already mentioned the oracle attacks and what could happen if the message was send afterwards. Those situations can and should be disregarded when answering the questions, even if they are definitely worth considering when implementing such a scheme in practice.

The reason is that you first need to get down the security of perfect schemes and can then on designing or analyzing systems based on the security claims. Then the next thing to do is to consider the practical systems. I'm however already very much rooted in practical application, so my brain starts to automatically insert warnings when looking at the schemes.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ Sorry, I missed saying that this protocol is perfect...So the shared key is secure, and certificate x509 is valid. I think that these exercises is asking this infosec property without attack $\endgroup$ – theantomc Feb 8 at 17:55
  • $\begingroup$ I think I've got that covered in my answer. I've just reread it. if you have any specific issues with it, let me know! $\endgroup$ – Maarten Bodewes Feb 8 at 18:23
  • 1
    $\begingroup$ Right! Changed the reason for the NO and removed the part where it says that it is debatable. $\endgroup$ – Maarten Bodewes Feb 9 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.