2 ms·
I'm confused about what the benefit of a malleable cipher is if you still have a HMAC. Is it just for Alice or Bob to be able to say "that's our ciphertext but
by bastawhiz 5y ago
I'm confused about what the benefit of a malleable cipher is if you still have a HMAC. Is it just for Alice or Bob to be able to say "that's our ciphertext but not our symmetric key"? But in that case the HMAC would also need to be forged, right? If Eve publishes the ciphertext and the legitimate plaintext and the legitimate key, wouldn't Alice and Bob have to say "that's a forged HMAC" with a malleable cipher versus "all of that is forged" with a non-malleable cipher? How is the former more deniable?
Unless the point is that Eve isn't trying to expose the messages so much as be certain they are produced by Alice and Bob? But in that case, how would Eve have gotten a fourth party's forgery in the first place?
- josephcsible 5y agoThe signing key gets published right after the recipient verifies the message with it. Also, the signing key is derived from the encryption key, so you always know the former if you know the latter.