Subject: RE: secure sign & encrypt

From: Terje Braaten <[email-masked]>
Date: Thu, 23 May 2002 22:02:30 +0200

Derek Atkins <[email-masked]> wrote:
> I'm not sure exactly what you mean by when you say Alice saves a copy
> of the session key... How does Alice get that key to Charlie?  Also
> keep in mind that the interior and exterior encryptions SHOULD be
> using different session keys.  So, I don't understand what you mean?

She could send it to Charlie in a different mail, or add it on the outside
of the signature (ES) packet before she encrypt and send it to Charlie.
And since she control the building of the message, another solution
would be that she could also use the same session key in the interior and
exterior encryptions no matter what the protocol says should be done.

> 
> Can you show the packets that Charlie sees?  I don't see any way
> to add a new ESK on the interior message without invalidating the
> signature....

Charlie sees after decrypting the first layer
 PreSig[Alice]{ESK [Bob] Enc { Literal { Message } } }PostSig[Alice]

In addition he has, or can make ESK[Charlie]. This information he can
claim he must have got from Bob, since he is the only original recipient.

-- 
Terje Bråten

---

From: Derek Atkins <[email-masked]>
Date: 23 May 2002 16:21:50 -0400

> exterior encryptions no matter what the protocol says should be done.

But then Charlie KNOWS that Alice did the dastardly deed.  Moreover,
you'd need extremely special reader to be able to read such a message,
because it would not be 2440-compliant.

>  PreSig[Alice]{ESK [Bob] Enc { Literal { Message } } }PostSig[Alice]

Ok, can you show me the complete message Charlie receives (before he
decrypts the first layer)?  Note that if Charlie sees this message, it
is quite clear that the message was meant for Bob alone.

> claim he must have got from Bob, since he is the only original recipient.

How can Charlie insert an ESK[Charlie] and not invalidate the
signature?

> Terje Bråten

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available