Problem - Kevin Tafuro

et = RSA_verify(NID_sha1, hash, 20, sig, siglen, r);
RSA_blinding_off(r);
BN_CTX_free(c);
return ret;
}
See Also
Recipes 7.4, 7.12
7.14 Securely Signing and Encrypting with RSA
Problem
You need to both sign and encrypt data using RSA.
Solution
Sign the concatenation of the public key of the message recipient and the data you
actually wish to sign. Then concatenate the signature to the plaintext, and encrypt
everything, in multiple messages if necessary.
Discussion
Naïve implementations where a message is both signed and encrypted with public
key cryptography tend to be insecure. Simply signing data with a private key and then
encrypting the data with a public key isn’t secure, even if the signature is part of the
data you encrypt. Such a scheme is susceptible to an attack called surreptitious forwarding.
For example, suppose that there are two servers, S1 and S2. The client C
signs a message and encrypts it with S1’s public key. Once S1 decrypts the message, it
can reencrypt it with S2’s public key and make it look as if the message came from C.
In a connection-oriented protocol, it could allow a compromised S1 to replay a key
transport between C and S1 to a second server S2. That is, if an attacker compromises
S1, he may be able to imitate C to S2. In a document-based environment such
as an electronic mail system, if Alice sends email to Bob, Bob can forward it to Charlie,
making it look as if it came from Alice instead of Bob. For example, if Alice sends
important corporate secrets to Bob, who also works for the company, Bob can send
the secrets to the competition and make it look as if it came from Alice. When the
CEO finds out, it will appear that Alice, not Bob, is responsible.
There are several strategies for fixing this problem. However, encrypting and then
signing does not fix the problem. In fact, it makes the system far less secure. A secure
Securely Signing and Encrypting with RSA | 343
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.