Subject: RE: Ordering of encryption and signing of a S/MIME message

From: "Housley, Russ" <[email-masked]>
Date: Mon, 21 Oct 2002 07:43:15 -0400

Bernd:

In most situations, I recommend sign then encrypt.  This provides signature 
on the plaintext.

There are application-environment reasons to deviation from this 
approach.  However, one must take care.  If one does encrypt then sign, the 
resulting structure is:
	ContentInfo
	  SignedData
	    EnvelopedData
	      Content

An attacker can strip the SignedData encapsulation, making the recipient 
think that the originator sent an encrypted-only message.  However, this 
construct is safe if the recipient will disregard any unsigned messages.

Russ

-----Original Message-----
From: Bernd Matthes [mailto:[email-masked]]
Sent: 17 October 2002 16:22
To: ietf smime
Cc: Matthias Genkel; Dr. Stephen Henson
Subject: Q: Ordering of encryption and signing of a S/MIME message

Hi to all!

My Question is:
Is it useful a message as first to encrypt and
then to sign the encrypted result,
in example the encapsulatedData of a pkcs7SignedData structure
is a pkcs7encrypted data structure?
I know, it's senseless... ;-) but i found nothing in the standards.
Is there any sensible reason against this procedure(i hope so)?

thanks in advance.

with kind regards
-- 
Bernd Matthes                   Gemplus mids GmbH --
Senior Software Engineer    	   formerly Celo Communications GmbH
Dipl.-Ing.(FH)                  R&D Center Germany

---

From: "Blake Ramsdell" <[email-masked]>
Date: Mon, 21 Oct 2002 15:16:10 -0700

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Housley, Russ
> Sent: Monday, October 21, 2002 4:43 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: Ordering of encryption and signing of a S/MIME message
> 

Another argument in the early days was that "encrypt and then sign"
would allow an opponent to collect the signature information from the
message.

From a client perspective, it might be interesting to see how well they
behave when presented with a signature around encryption.  The "What
Would Outlook Do" argument.

Blake