Subject: RE: Ordering of encryption and signing of a S/MIME message

From: [email-masked]
Date: Mon, 21 Oct 2002 10:13:23 +0200

Bernd,

For security reasons, you should first sign your message and then encrypt it with the recipient's public key. If you perform the the reverse operation (encrypt then sign), then a threat agent may  
intercept you message, skip your signature and sign "your encrypted" message. So the recipient will hence receive a signed message from the threat agent and no more from you.

malek

___________________________________________________________
Malek Bechlaghem
e-Security Product Development Manager
Tel.: +32 2 202 79 02
Fax: +32 2 202 41 06
E-mail: [email-masked]

-----Original Message-----
From: Bernd Matthes [mailto:[email-masked]]
Sent: 17 October 2002 16:22
To: ietf smime
Cc: Matthias Genkel; Dr. Stephen Henson
Subject: Q: Ordering of encryption and signing of a S/MIME message

Hi to all!

My Question is:
Is it useful a message as first to encrypt and 
then to sign the encrypted result,
in example the encapsulatedData of a pkcs7SignedData structure 
is a pkcs7encrypted data structure?
I know, it's senseless... ;-) but i found nothing in the standards.
Is there any sensible reason against this procedure(i hope so)?

thanks in advance.

with kind regards
-- 
Bernd Matthes                   Gemplus mids GmbH --
Senior Software Engineer    	   formerly Celo Communications GmbH
Dipl.-Ing.(FH)                  R&D Center Germany
--------------------------------------------------------------------
"Complexity breeds bugs. Bugs prevent adoption, lack of" \
"adoption results in death. Death not good." "Life sucks."

**** DISCLAIMER **** 
"This e-mail and any attachments thereto may contain information 
which is confidential and/or protected by intellectual property 
rights and are intended for the sole use of the recipient(s) named above. 
Any use of the information contained herein (including, but not limited to, 
total or partial reproduction, communication or distribution in any form) 
by persons other than the designated recipient(s) is prohibited. 
If you have received this e-mail in error, please notify the sender either 
by telephone or by e-mail and delete the material from any computer. 
Thank you for your cooperation."

---

From: Antoine Alberti <[email-masked]>
Date: Mon, 21 Oct 2002 11:44:57 +0200

> For security reasons, you should first sign your message and then encrypt 
it with the recipient's public key. If you
> perform the the reverse operation (encrypt then sign), then a threat 
agent may
> intercept you message, skip your signature and sign "your encrypted" 
message. So the recipient will hence receive a
> signed message from the threat agent and no more from you.

And how can the threat agent do this using the expected private key? And if 
it can't, wouldn't the receving agent have a serious security hole if it 
accepted such a message?

Curiously yours.

---

From: [email-masked]
Date: Mon, 21 Oct 2002 15:09:12 +0200

Antoine,

Paul Syverson's paper, "Limitations on the design of public key protocols", discusses several attack scenarios regarding the order of operations within the flow of a cryptographic protocol (sign and encrypt, encrypt and sign, ...). If you are interested, you can download it from 

http://citeseer.nj.nec.com/syverson96limitation.html

Going back to your remark, indeed, unless you avoid such threat at application level (having for instance a list of trusted signatory), it is difficult to avoid to be immune from such treats especially when the signature verifier is an automatic process that performs dedicated operations  after a successful signature verification.

Best regards,

malek.

-----Original Message-----
From: Antoine Alberti [mailto:[email-masked]]
Sent: 21 October 2002 11:45
To: [email-masked]'
Subject: RE: Ordering of encryption and signing of a S/MIME message

agent may

Curiously yours.

**** DISCLAIMER ****