4 ms·
Don't such systems generally encrypt first and then sign the encrypted text, specifically to avoid this? Your points about subject lines and other assorted hea
by koenigdavidmj 14y ago
Don't such systems generally encrypt first and then sign the encrypted text, specifically to avoid this?
Your points about subject lines and other assorted headers are correct.
- betterunix 14y agoThe link I provided discusses this as well; not only are there other attacks, but those other attacks are potentially more severe. A man-in-the-middle attacker can claim credit for a message by substituting their own signature for the sender's. A naive encrypt-then-sign system will also lack non-repudiation in some cases (e.g. when using RSA signatures and encryption), and will only provide non-repudiation on the ciphertext itself (not the plaintext; this may or may not be what you want).