Does an email signature increase security?

Question

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to exchange a symmetric key then use this key to encrypt emails via AES.

When Eve doesn't know the key, she can't modify ciphertext to change Alice's or Bob's message or send a fake message that claim is from Alice or bob because when they try to decrypt that email with the key exchanged before, decryption fails.

I think even MAC is waste of energy. What's the point of signatures here for every new email?

Answer 1

A symmetric key can certainly transmit data securely from Alice and Bob. When they use a symmetric key, they can be sure that:

• the mail was not tampered with in transit
• the mail was not viewed in transit

The PGP key exchange will allow them to work out a way to trust each other, traditionally in a Web of Trust model. The trick with PGP is that until later versions, there was not creditable authority that both Alice and Bob depended on - that's the big variation between PGP and a PKI system that provides email signatures and encryptions in most mail clients.

The issues are in in several parts:

• in a symmetric key exchange, there is risk added with each person who knows the key. If Alice and Bob want to resend the mail to Charlie, either they will have to share the symmetric encryption key with Charlie or either Alice or Bob will have to create another encryption key for sending Charlie. If there will be multiple mails between Alice, Bob, and Charlie, there could be 3 keys (Alice/Bob, Bob/Charlie, Alice/Charlie) - this increases exponentially as more people join in the conversation.

• point to point encryption does not prove lack of tampering between the points. If Bob mails a mail to Alice, and Alice gets ticked off and forwards the mail to Charlie saying "Look what Bob wrote!", there's no proof that the mail actually came from Bob if the encryption was from Bob to Alice and then Alice to Charlie. Alice could have faked it or modified it. However, if Bob had signed the mail to Alice, and then Alice forwarded Bob's mail to Charlie, Bob could not easily claim that Alice messed with it, so long as the signature remains intact. The email and signature can be stored indefinitely, and in the clear with this method of security.

• Assymmetric encryption (typical email encryption when you use a mail client) is based off of having a repository of known credentials of other users on hand and knowing exactly what key pair to use to route a mail to any given recipient. This mitigates the key distribution problem - I have a safe repository of secure methods to send to anyone in the system, and we didn't have to exchange keys. If someone looses their key pair, only the mails they themselves have received will be compromised. If we used a symmetric key pair as a group, all group communications would be at risk.

All that said, setting up key pairs, and directory services serving certificate credentials for a group of people is a non-trivial task. Making a self-signed certificate is pretty easy, but also pretty worthless - the value is having it in a system with shared trust coming from a common source, and creating that system and maintaining it requires some effort.

It's not overkill, but it's not easy - so it's the sort of thing you bother with when there's a value to non-repudiation (Bob can't deny that he mailed the mail), and private communication across a larger group of people. For two people the value is much, much smaller.

Answer 2

Email signatures allow others to prove that an email is:

• actually from you
• not modified in transit

If you don't care, then don't sign.

Answer 3

Encryption alone does not provide data integrity. Thus, we need to use something like a MAC or digital signature to provide integrity checks. You may be interested to read this. Is there an attack that can modify ciphertext while still allowing it to be decrypted?

Answer 4

Signed mails do not bring any security first-hand. All they (can) bring is trust in the sender and thus the message. You can use this trust to decide whether it is (in)secure to do whatever with its contents, but it's still your decision.

Key management

If an organization of 100 people want to communicate, each pair of them will have to exchange (and maintain!) such keys -- several thousands all in all. Using public-private-crypto, all they need is 100 pairs of keys.

Also, you will be able (or could be able) to communicate with everybody trusting your key (how to achieve this depends in OpenPGP and X.509) and the other knows for sure who you are. For sure. No way to do this without meeting with symmetric encryption.

Also: there are applications where you want to sign, but not encrypt. How to "sign" using symmetric encryption for the public: mailing lists, software packages, ...?

Symmetric encryption in OpenPGP

In the end, OpenPGP is nothing more than a wrapper that puts trust and key management around symmetric encryption which is used for acceptable performance when encrypting (OpenPGP is a hybrid crypto system; public-private-crypto is very expensive for encrypting large data, signing only encrypts a hash sum of the data and thus does not require symmetric encryption).

Answer 5

You could do it with symmetric keys, but then:

• You would have to exchange keys first with every person you want to communicate with - so why not use PGP directly on every message instead?
• You would not be able to (easily) sign a message that goes to multiple people, since you would need to have one AES key for every person, and thus need to "sign" the message multiple times
• You would not be able to sign a message directed at the general public (e.g. a release announcement)
• There is no compelling reason to do so since, as you pointed out, an asymmetric key exchange would still be needed

Also, it is not enough to encrypt a message to ensure authenticity. Most notably, with stream ciphers (or block ciphers in CTR mode), I can easily change a specific bit without messing the message up. Thus, if I know what you are writing, I can change the message to anything else. With block ciphers, I can at least damage the message randomly - it may be an obvious change, but it is a change. Various other attacks exist that have little practical impact or are relevant only in very specific cases, but in crypto, you don't take unnecessary risks. If something shows weaknesses, you fix it. Finally, there are use cases (e.g. release announcement, see above) where you want to sign but not encrypt a message - thus the need for signatures, and when you already have them, you use them for everything instead of signing half the messages one way and half the messages the other way.

Answer 6

Imagine that Alice wants to sent Bob an email really securely. She seeks an Open WLan and sends the email. The moment she sents the email bob isn't online.

There no time for Bob to sent Alice a key for symmetric encryption. If Alice and Bob are online at the same time they can use a protocal such as Jabber with OTR with uses the fact that both are online at the same time.