Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Question

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and then encrypt the signed message with, say, Charlie's public key and forward the resulting ciphertext to Charlie. Could Alice prevent this "attack" by using symmetric key cryptography?

Answer 1

Is your issue that Bob leaked the data to Charlie? There isn't anything you can really do about this. If Bob can read the data, he can always share it with someone else. If symmetric key cryptography was used, Bob could just send the key itself to Charlie as well as the encrypted message. Better yet, he can still just the decrypted message. There is no way to prevent Bob from doing things if he's the intended recipient of the data.

Answer 2

In addition to Oleksi's answer, depending on the type of data A can have B sign a non-disclosure agreement, secretly embed unique identifiers within the work (like a watermark in an image/video; a message hidden within the least significant bits like in steganography; or change the names of variables in source code) that identifies that this data was given to B. If the data is later publicly leaked, you can examine the leaked data to identify B as the source of the leak and sue for damages or at least cut B off from your stream of sensitive information in the future.

Granted if your method of putting in secret identifiers is known it can probably be scrambled before copying, but this could help ensure that B treats your data as a valuable secret.

Answer 3

That's not a man-in-the-middle attack; that's willful information disclosure scenario. If Bob can decrypt the message, then Bob can leak the message to anyone he chooses.

Your question is actually about DRM (Digital Rights Management or Digital Restrictions Management). If your ciphertext decrypts to plaintext that is still in a proprietary format that can only be understood by a proprietary program, then that program could attempt to prevent data leakage by means such as

• verifying that it is running on Bob's computer
• authenticating Bob biometrically
• "phoning home" to a master server for authorization
• forbidding copying text to the clipboard
• forbidding printing

Of course, DRM is always circumventable. DRM can be broken by cracking the cryptography and data format, reverse-engineering the proprietary program, stealing the keys, or interfering with the way the program interacts with the computer. The most basic workaround for Bob would be to take a photo of the screen.

Answer 4

This thread is a little old, but for clarification the original question may have been referring to the fact that sign and encrypt is subject to "surreptitious forwarding" and is therefore flawed. Suppose Alice generates the message "I love you", signs it, encrypts it with Bob's public key and sends it to Bob. Then Bob could decrypt it with his private key and (for whatever reason) reencrypt it with Charlie's key and send it to Charlie. Charlie can be sure that Alice signed the message but he does not know who encrypted it and so could be misled into believing that the message was intended to be sent to him by Alice.

So @mudasser asked, can this be solved using symmetric keys?

For the same flaw to be apparent Alice, Bob and Charlie would all need to possess the same key but Charlie would need to be unaware that Bob has it. This comes down to how well the keys themselves are kept secret which depends on secure processes both for exchanging and keeping the keys.

A better solution to the problem is to make the intended recipient explicit in (or with) the original message prior to signing by Alice. In my example, if Alice's message had said "To Bob, I love you" then Charlie would not have been misled into thinking he was the intended recipient, And thus it doesn't matter whether symmetric or public keys are used.