1

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and the session/symmetric key is encrypted using the receiver's public key.

I assume the reason the signature is created from the plaintext (aside from ease of logistics) is so this signature can't be removed and replaced with another signature. Is that correct, or is there another reason? By signing before, the receiver runs the security risk of decrypting an unauthenticated message.

  • Are you asking why the is signed-then-encrypted rather than encrypted-then-signed? – not2savvy Jun 26 at 6:39
  • Does this thread about authenticity answer your question? The receiver will verify the authenticity of the signature and know when the plain text has been tampered with. – lab9 Jun 26 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.