Privacy and Integrity in Public Cryptography I'm trying to figure out which is the best way to get privacy and integrity together in public cryptography.

Alice needs to send multiple files $f$ (may be big) to Bob.

I've thought:

Alice computes the hash of the file $h(f)$.

Alice signs $h(f)$ with her private key.

Alice encrypts with Bob's public key $f$ and $Sig_a(h(f))$ resulting in the ciphertext $Enc_b(f, Sig_a(h(f)))$.

Only Bob can decrypt with his private key: privacy guaranteed.
Once Bob decrypted, can verify Alice's signature.

In my opinion this protocol provides privacy and integrity together, right?

Update

So, according to your answers, here's what i've understood:


The protocol is terribly inefficient because it encrypts a large file using public cryptography. This would require to split the file in n chunks ($f_1,f_2,...f_n$) and to send to Bob $Enc_b(f_i, Sig_a(h(f_i)))$ for i = 1 to n. This may require a padding.
A bad guy (Charles) that receives $Enc_c(f, Sig_a(h(f)))$ could decrypt it and re-encrypt it with Bob's public key and send it to Bob. No confidentiality.
In order to fix this, Alice should perform $Enc_b(f,A,Sig_a(h(f),B))$


At this point we can say that:


This protocol (as it is) MAY (depends on how it is implemented in practice) guarantee integrity.
I would use Diffie-Hellman key-exchange protocol (the ephemeral version) to estabilish a secure channel and use symmetric cryptography.


Update 2

Not even integrity is guaranteed. I've seen the so called "message malleability".
Signing and encrypting together is not secure in this method, at least in the way most would perceive security. For example, Bob would likely interpret this message as being sent from Alice to Bob. However, Alice may have sent it to Charles who decrypted and re-encrypted the signed message under Bob's public-key. In order to do this securely, you need to add the sender's and receiver's identities inside (the signature with Alice's key should contain Bob's identity, and the encryption with Bob's key should contain Alice's identity). In addition, you need to use CCA-secure encryption. In short, this isn't so simple and you need to check the details in order to determine if it's secure. This topic is called "SignCryption" and you can look it up for more information.