We all know about how Digital Signing works. I just have some questions about vulnerability risk.
At first, As I know, the Signature and the Data are separated and we can split the document into two different parts. So we can change both and then re-join them together.
Second, I think In network transfer layer, we have no trust and the MIM attack is always possible.
Now, suppose I'm the MIM. I can get data, split it into Content and Signature, change the Content, sign it with my own Private Key then send it to the other party. I also can change the Public Key of the first party on the way and replace it to my own one.
So, Don't you think if the receiver gets the public key of the sender on the Internet, the MIM would be possible as I explained?
I myself think the scenario is too easy to be a real problem, I think I don't have enough knowledge about. Can you explain it in simple?
Note that I have same problem on the SSL/TLS and the CA ... I think they are also vulnerable when they're using on the Internet that simply and the attackers may have access to the hardwares and network appliances (like governments).