I suppose one reason for prepending the name would be that a malicious Bob could pose as Alice by encrypting the exact same message + Alice's signature using Charlie's public key, and trick Charlie into believing that Alice sent him the message.

is a comment on an answer to the question Should we sign-then-encrypt, or encrypt-then-sign?. It is very interesting. I had not thought of that attack.

I wonder if instead of prepending the name, one could encrypt the message, then generate and append the signature, and then encrypt everything with the same key and send the result. Sometimes it might be convenient not to prepend the name.

  • $\begingroup$ Why do you need double encryption? When it is not appropriate to add the signer's name? is it secret? $\endgroup$ – kelalaka May 30 at 20:06
  • $\begingroup$ @kelalaka I'm not sure when you might want to not add the name, but it seems likely that someone sometime would not want to. Or what if the sender had forgotten the name? $\endgroup$ – Security Every Day May 30 at 20:10
  • $\begingroup$ are you talking about anonymous signatures? $\endgroup$ – kelalaka May 30 at 20:12
  • $\begingroup$ @kelalaka What are they? $\endgroup$ – Security Every Day May 30 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.