How can digital signatures assure the sender their message has been correctly received?

Question

I am going through a short course on security. One of the videos is talking about non-repudiation in regards to cryptography and sending messages between Alice and Bob. This video talks about how digital signatures can be used to verify the sender of a message, which I understand (Bob decrypts the message with his private key, and then has access to the certificate which contains Alice's identity and a hash that can be verified with Alice's public key). It also talks about how Alice can be assured that Bob has received the message and that, in general, the message has been received by the correct party.

It does not explain how this is possible though. I have seen some mention online that one method might be that Bob then sends a digital signature back to verify he has received the message. Is this indeed a method of doing this? Are there other methods to do this? If this method is right, how can Alice be sure that Bob isn't just randomly sending digital signature out, and has in fact seen the correct message?

Answer 1

PKI ensure that if the message reaches its destination it has not been altered (if signed with sender private key) and/or has not be compromissed (if crypted with recipient public key).

If the sender wants to make sure that the recipient has actually received the message, a higher level protocol must be used. For example the recipient could send a signature of the original (optionaly decrypted) message using their private key. So if the round trip:

A -> message signed with A private key -> B
A <- signature of the original message with B private key <- B

completes, then A can be sure that B has received the correct message.

If you do not set up that round trip, even with modern system where the sender can be sure that the message reaches the recipient system, you have no protection against the message being destroyed between its arrival on a machine and the moment when the human being named B could read it.

This would be more or less an implementation of what was the QSL in the early days of radio frequency message (mainly using Morse code). BTW that QSL was still in use in the 80's to ensure that a message had been received and understood (*): until the sender had not received a QSL to message number xxx they periodically try to send it again or try a phone call to know whether the recipient system was off or out of use (at least at French Met Office).

---

(*) as QSL to message ... had to be manually sent, it meant that somebody could read the message number and declared having understanded the full message.

Answer 2

It also talks about how Alice can be assured . . . that, in general, the message has been received by the correct party.

The message here is the information, not the encrypted blob. Alice could have encrypted the message and posted it on a billboard at Times Square, and nobody but Bob would receive the message, because only Bob have the private key to transform the encrypted blob in the message. That's what the message has been received by the correct party means. Alice does not have any way to really be assured that Bob and only Bob received the encrypted blob, and it's not really possible to design around this and use the internet. Only if Alice handed out the blob in person she could be sure of that, but in this case maybe no encryption would be needed.

Having a protocol to send back a message to Alice would end up on the Two Generals Problem: Bob sends a message back to Alice but isn't sure Alice received the message, so Alice would have to send a message back, and so on.

Alice could ask Bob to acknowledge the reception (by calling him, by asking in the message to send her a SMS, or to put a green vase on the wall), but that isn't part of PKI.

Answer 3

The sender is assured by implication, not through an active assurance process.

Because the PKI/certificate/signing process works, then the sender "knows" that what was sent was what was received. The receiver has the same assurance.

Because the system works, the signature can be trusted that the message was sent by Alice. If it was not the correct message, the signature would fail.

Answer 4

Digital signature cannot. Digital signature can only provide integrity protection and non-repudiation. Delivery receipts can only be assured by the server when the client polls for new messages and fetches them. Sender cannot trust the recipient for delivery confirmation. The recepient can block delivery receipt to pretend that the message was never received.

However for read receipts, sender has to rely on the recepient because the server cannot confirm to the sender that the recepient has read the message. So recepient can block read receipts. Some messengers already allow users to disable it.

How can Alice be sure that Bob has seen the correct message?

Incorrect or tampered messages aren't supposed to be processed by the client. Alice won't come to know if the message that has been tampered with has been read by Bob. Client should either throw exception to let the recipient know about the status or should request resend from the sender. This is on client's implementation.