1

I'm not quite sure if I understood integrity deep enough.

Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to get their private keys, and is eavesdropping on their channel. The hacker is doing the following:

  1. Receive the message sent from Alice to Bob.
  2. Decipher it (he has Bob's private key).
  3. Read the message.
  4. Recipher it and rehash it (only the parts from the message which should be hashed. e.g the header).
  5. Resend it to Bob.

Let's exclude the point that Bob would receive the message twice, let's suppose that the hacker has the possibility to remove the original message from Alice after that he received it.

Would Bob be able to detect that someone else did read this message? If so, how?

  • Signatures provide integrity and authentication. However, when the private key is leaked, the signature does not provide any security property anymore. – A. Hersean Oct 10 at 11:59
  • 2
    If the hacker doesn't modify the message, why would he need to recipher and resend it? – Anders Oct 10 at 12:06
  • @ A. Hersean: Thanks a lot. – abdulrahman alturh Oct 10 at 13:43
  • @ Andreas: Thanks for your comment, and here is my answer: The hacker in this case is interested in the complete communication between Alice and Bob. He wants Bob to receive the message from Alice (Or which was originally from Alice) and answer it. So he would be able to continue eavesdropping without being caught. – abdulrahman alturh Oct 10 at 13:46
1

A signature scheme can only then assure integrity, if the signing keys are kept secret.

Here's a definition for integrity: Data remain in their given state if at rest.

Side notes: Integrity is lost, when data is edited. If they are edited by someone that is authorized to change them, integrity is still lost. If a scheme is in place, to authorize systems or people to change data, it can be shown, who modified them. It does not (typically) include if data has been read.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.