Skip to main content
4 of 6
added 57 characters in body
Maarten Bodewes
  • 94.5k
  • 13
  • 165
  • 319
  1. ENC(M) || SignA(ENC(M))
    Have confidentiality (from ENC), and authenticity from signature, but no integrity because i have the signature of ENC (so someone can use forgery on my signature) and non-reputation i don't think (but i m not sure).

Confidentiality is yes because of ENC, correct.

The other's are all linked to each other. They are present if the receiver only accepts signed messages and the verification is performed with the trusted public key of Alice. If a public key of an adversary is accepted then any random ciphertext can be created and signed.

Non-repudiation is harder, because the signature is not over the actual message, you would have to store the secret key with the message after you've received it. They probably expect NO for non-repudiation and YES for confidentiality and message integrity / authenticity, but I think that's contentious.

  1. ENC(M || SignA(M))
    This have all property, because ENC give confidentiality, signature authenticity e non repudation and integrity because i have message and his signature for verify.

But yes, basically right. Note that if the encryption scheme is vulnerable against e.g. plaintext / padding oracle attacks that the confidentiality breaks down. This scheme is what we usually do.

  1. SignA(ENC(M))
    In this schema i have confidentiality and authenticity , but no integrity. I m not sure about non-repudation.

The message is not send (!), so it is kept very confidential. You cannot even guess it, because the signature is over encrypted data. Integrity / authenticity are then of course nonsense. Non-repudiation is also not possible.

Unless somebody is able to get the original message and encrypt it again anyway. But usually only the given message are allowed (or you'd have issues with DoS and replay attacks and whatnot).

  1. ENC(M) || SignA(M)
    With this schema i have confidentiality, integrity and authenticity. I have again doubt about non-repudation.

Wrong! You can guess the data and verify the signature. If it verifies, you've found the data. We commonly assume that the public key is known to all.

Once you've decrypted you have M, SignA(M) so there is your non-repudiation - and therefore integrity & authenticity.

Again: if the encryption scheme is vulnerable against e.g. plaintext / padding oracle attacks that the confidentiality breaks down (even more significantly for complex messages).

Maarten Bodewes
  • 94.5k
  • 13
  • 165
  • 319