1

Backstory

The system I'm designing requires encrypted messages as well as message authentication. AES-GCM seems like the logical choice due to its authentication capabilities and high throughput.

The key used to encrypt a message is generally randomly generated per message and encrypted using the recipient's public key. The encrypted key is sent along with the message.

There are generally no persistent key between both parties.

Example

Let's take the following message as an example:

{
  "timestamp": "2017-01-01",
  "encryptedMessage": "...",
  "sign": "..."
  "key": "..."
}

The value "timestamp" is in clear text, "encryptedMessage" encrypted, "sign" holds the RSA signing of "timestamp" and "key" holds the encrypted key. In this example. Would it make sense to sign "encryptedMessage" as well?

Question clarification

Are there any benefits of using RSA signing over the authenticity provided by AES-GCM?

Would it make sense to sign a message already encrypted using AES-GCM?

Improve this question
2
  • Your requirements are not clear to me. Will there be a shared key between sender and recipient (which need to check if the message is authentic)? If yes then you don't need RSA. Or do you need a public key at the recipient and a secret private key at the sender instead? Then RSA (or ECDSA or similar) is the one you should use. Also, where does the encryption key come from?
    – Steffen Ullrich
    Sep 22, 2017 at 17:58
  • @SteffenUllrich please re-read the questions as I have hopefully clarified the points you made.
    – Alex
    Sep 22, 2017 at 18:09

1 Answer 1

Reset to default
1

The authentication part of AES-GCM relies on a shared key between sender and recipient which is only known to sender and recipient. In your scheme the encryption (and thus authentication) key is not bound to a specific sender, i.e. everybody knowing the public key of the recipient can create such a message. And since the public key is considered public this means everybody can do it. Thus, the authentication part of AES-GCM does not prove that the message comes from a specific sender but only that all parts of the message come from the same sender, i.e. the one which generated the secret key.

Public key encryption with RSA or other allows instead to prove that the message comes from a specific sender, i.e. the one owning a specific private key where the recipient already knows the senders public key. This prove involves that a relevant part of the communication is signed by the private key of the sender. While the sender could sign the random key the system might break if some attacker gets access to a single key (by hacking the recipient) and could then reuse the captured key and the matching signature in all further messages (i.e. replaying the signature). Therefore instead the message itself should be signed.

In summary, AES-GCM and RSA provide different levels of authentication. Which one you need depends on your specific use case. But, if you need to be sure that the message came from a specific sender (and not some attacker) then AES-GCM alone is not sufficient.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .