Subject: RE: secure sign & encrypt

From: Terje Braaten <[email-masked]>
Date: Thu, 23 May 2002 14:54:23 +0200

Derek Atkins <[email-masked]> writes:
> You see, I view this just like regular mail.  There is the envelope
> information, and there is the "letter".  By _CONVENTION_ the person
> writing a letter duplicates the envelope information on the inside.

A very useful picture indeed. The PGP program puts the information
about who it is encrypted to on the envelope on the outside. So
if we want to have this convention the PGP program must also be the
application that put this same information on the inside of the
envelope. The natural place to do this, as I see it, is for the PGP
program to make additional signature packets and put it in the signed
part of the signature.

If the OpenPGP protocol is not changed, there is no way for any PGP
application to implement any such convention. So it has to be a
part of the OpenPGP protocol.

> Repeat to yourself: IT IS A FEATURE THAT SIGN AND ENCRYPT ARE
> SEPARABLE OPERATIONS.  Once you make that statement, there is no way,
> short of layering violations, to do what you want to do except at the
> application later duplicating the information.

And I say it is a security flaw that that sign and encrypt must be
separable operations, and for the implementation of an atomic and secure
sign & encrypt you have to make an exception to this layering model.

-- 
Terje Bråten

---

From: "David P. Kemp" <[email-masked]>
Date: Thu, 23 May 2002 09:21:50 -0400

> sign & encrypt you have to make an exception to this layering model.

Your proposal for an extra packet does not address this alleged flaw.
Note that Alice could sign a message saying "encrypted to Bob", and then
encrypt and send the message to Charlie, thus framing Bob for breach
of confidence.

You can't take two operations that are inherently separable and create
a magic hack that makes them inherently and verifiably atomic.  Each
layer does what it does - if you want the security services provided
by three layers (ESE), or what S/MIME calls triple-wrapping (SES),
then you must use three layers.