2

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML

and in section 5.1  Naming Repairs

By signing Bob's name into her message, Alice explicitly identifies him as her intended recipient.

or

she should encrypt her own name along with her message

Is that including in Alice's plaintext the signed Bob's name or the encrypted Alice's name? Does that mean that you can sign or encrypt specific parts of a message?

So in this case, Alice has a plaintext message, signs Bob's name, adds the resulting signature to the plaintext and then signs the whole thing?

Or how does that work with encrypting Alice's name?

1

she should encrypt her own name along with her message

Is that including in Alice's plaintext the signed Bob's name or the encrypted Alice's name?

This (5.1.2) is discussing the "Encrypt & Sign" format. In this use case, Alice writes a message to Bob, encrypts it with his key, and then signs the encrypted blob with her key. If she does not include her name inside the inner Encrypted portion, then Clara could extract the encrypted blob, re-sign it with Clara's key, and then send it to Bob pretending it is from Clara rather than Alice.

Does that mean that you can sign or encrypt specific parts of a message?

Signing and encrypting are separate operations, and usually nested in one way or another. As for having a message with mixed encrypted/signed and plaintext parts - sure, depending on the message format. A MIME message can easily contain both. But that's not really what this section of the document is talking about.

So in this case, Alice has a plaintext message, signs Bob's name, adds the resulting signature to the plaintext and then signs the whole thing?

You're conflating two different cases with your quotes; 5.1.1 (Sign & Encrypt) and 5.1.2 (Encrypt & Sign).

In the first case, Sign & Encrypt, because the Signature which identifies Alice is safely ensconced within the outer Encryption layer, Alice does not need to identify herself. However, to ensure the decrypted message contains the recipient info that would be stripped off at decryption, she does need to include Bob's name. Alice's signature and Bob's plaintext name, both encrypted with Bob's key, make for a secure message.

In the second case, Encrypt & Sign, because Alice's signature can be stripped off, she needs to ensure that her plaintext name is inside the Encrypted portion.

All in all, the text of 5.1.3 is probably most useful:

If Alice encloses both names in the message-body, she can avoid having to pay attention to cryptographic choices early on, while she's formatting her message text. She can send to Bob in [either way]:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.