Benefits of signing RSA-encrypted data? I recently came across this (PDF) journal article, which describes what it calls "A New Design Of A Hybrid Encryption Algorithm" (which I must say, doesn't sound very novel, even in 2014!):


An AES key K is chosen
Encrypt message M using AES and key K

eM = AES-encryption(M)
AES key K is encrypted using RSA with the public key of the receiver

eK = RSA-encryption (K)
The cipher text eM is fed to SHA1, which generates a 160-bit message digest

mD = SHA1 (eM)
The message digest is signed using RSA with the private key of the sender

DS = RSA-sign (mD)
The encrypted message eM, digital signature DS and AES encrypted key eK are transmitted to the user over a network


So, basically standard AES-RSA hybrid encryption, but with the additional of an RSA signature (a signed message digest) that is intended to provide message authentication.

My question is whether signing the ciphertext actually provides any extra security (i.e. integrity or authentication) - doesn't encrypting the AES key with the receiver's RSA public key effectively provide message authentication?
Yes, signing the ciphertext does provide extra security, and yes, that would be integrity and authenticity of the message.

Encrypting with a public key does not provide integrity / authenticity against active attacks. That's kind of obvious: an adversary can simply encrypt another message with the public key - it is public after all.

The scheme however uses asymmetric encrypt-then-sign. This is dangerous as an adversary could strip off the signature to replace it with its own. That way it looks like the adversary has signed / send the message. However, this is only possible if the public key of the adversary is trusted within the system. More details are (indeed) here.

It will also be impossible to verify the message afterwards (unless you keep the ciphertext message as well, and make sure that the plaintext message and ciphertext message are irreversibly linked).

So when used correctly this kind of scheme provides integrity / authenticity. But it also has known limitations; that is: known to the cryptographic community, not the authors.



These kind of papers are used by the writers to get their degrees or progress within their studies. They provide zero insight and contain clear issues:


no mode of operation is defined for the symmetric cipher, no IV handling is performed;
the padding modes of RSA are not specified, not for encryption nor for signature generation ... there is only a limited description of the textbook RSA operation;
the hashing is not thought of to be part of the signature generation function;
the use of SHA-1 and the references to MD5 and blowfish, years and years after SHA-2 has been standardized.


And quite obviously there is no security analysis at all, which makes the entire paper a waste of bits and - worse - time.

The given "protocol" (and the quotes are needed here) could easily be extended with a message nonce and sender/recipient, making it more secure.