Subject: Re: Encrypt then sign insecure?

From: [email-masked] ("Hal Finney")
Date: Mon, 15 Aug 2005 20:47:24 -0700 (PDT)

<[email-masked]> writes:
> I am calculating a signature over private keypair. How the data to be
> signed differs from the public key? Are the fields: Salt, Initial vector,
> Coded count, encrypted dsa x, encrypted sha1 hash (20 octets) included to
> the signed data? Can someone clarify this?

OpenPGP does not support the notion of calculating a signature over a
private keypair.

Generally a signature is done on a public key as part of a certification
of that key that will be publicly available.  Signing a private key
would not be useful because the private key material is normally not
shared with others, so signature verification would be impossible.

Hal

---

From: Ben Laurie <[email-masked]>
Date: Tue, 16 Aug 2005 11:07:38 +0100

Hal Finney wrote:
> Ben Laurie wrote:
> 
>>Hal Finney wrote:
>>
>>>This paper doesn't apply to systems like OpenPGP which compose public
>>>key signatures with public key encryption.  Rather, it investigates the
>>>composition of symmetric encryption (e.g. AES) with MAC.
>>
>>...
>>This does not seem to me to be true. OpenPGP uses symmetric encryption 
>>under the hood, and signs the plaintext rather than the ciphertext. All 
>>that is needed is an oracle which will say whether the signature is 
>>correct or not.
> 
> 
> Krawczyk's paper is about combining MAC and symmetric encryption.
> That's not what OpenPGP does.  We don't do MACs.

Actually, the only point of the MAC is to tell whether decryption 
succeeded. Signatures do the same job.

>>Furthermore, OpenPGP does not use CBC, so the security proof from the 
>>paper doesn't help.
> 
> That's true, but the point is that the paper is not about systems like
> OpenPGP at all.

Yes it is. The required properties are: a) encryption and b) the 
possibility to detect errors in the plaintext.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff