Subject: Encrypt then sign insecure?

From: [email-masked] ("Hal Finney")
Date: Sun, 14 Aug 2005 09:36:14 -0700 (PDT)

I have changed the subject line as this is in regard to Ben's citation
of Hugo Krawczyk's paper on the order of signing and encryption,
http://eprint.iacr.org/2001/045, also published in Crypto 01.

This paper doesn't apply to systems like OpenPGP which compose public
key signatures with public key encryption.  Rather, it investigates the
composition of symmetric encryption (e.g. AES) with MAC.

Krawczyk shows that it is not always safe to first MAC and then
symmetrically encrypt, even if your MAC is secure and your symmetric
encryption algorithm is secure.  He does this by coming up with rather
artificial types of MAC and encryption which are individually secure
but which interact in a bad way when when put together like this.

Krawczyk also shows some constructions that ARE always safe, including
doing CBC with a secure cipher, then MACing the ciphertext.

Again, this analysis is not applicable to the PK digital signatures and
hybrid public/private key encryption used in OpenPGP.

Hal Finney

---

From: Bruce Lilly <[email-masked]>
Date: Sun, 14 Aug 2005 18:32:17 -0400

> composition of symmetric encryption (e.g. AES) with MAC.

The same cannot be said of Davis' analysis of issues in
http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html

---

From: Jon Callas <[email-masked]>
Date: Sun, 14 Aug 2005 16:45:53 -0700

> http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html

Davis is merely making a mountain out of a molehill. Cryptography 
cannot protect you from sending a message to a bad actor. Not even 
things like OTR can [1]. A word to the wise is that you shouldn't sign 
any message that you would be embarrassed to be made public.

Nonetheless, there's definitely a need to have secure messages that 
aren't signed. That's why we have the MDC construction in OpenPGP, so 
that you can have a reasonable assurance that a message arrived to you 
intact.

	Jon

[1] This is not a slam on OTR, which I think is brilliant. It is merely 
an observation that if you use a full privacy-enabled system like OTR 
and someone pastes a copy of your conversation into their livejournal, 
the people who read that transcript will presume it to be accurate. 
Furthermore, the fact that you used a juicy technology like OTR will 
make people *more* not less likely to believe it was accurate. This is 
an observation on human nature.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 15 Aug 2005 10:43:55 +0100

> hybrid public/private key encryption used in OpenPGP.

This does not seem to me to be true. OpenPGP uses symmetric encryption 
under the hood, and signs the plaintext rather than the ciphertext. All 
that is needed is an oracle which will say whether the signature is 
correct or not.

Furthermore, OpenPGP does not use CBC, so the security proof from the 
paper doesn't help.

I agree that the paper uses rather an artificial cipher (though the MAC 
can be any MAC) but it isn't clear to me what the limits of the attack are.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff