RSA - What's to stop someone from using the same ciphertext to mimic private key holder? I've recently looked into fundamentals of RSA and think I understand how it works. However, there's one basic problem I can't seem to figure out. If someone received ciphertext for a given message, what is to stop them from sending the same message/ciphertext to other nodes in a network and pretending to be the private key holder?

For example, suppose Alice is a general and commands soldiers Bob, Sue, and Jerry. Alice generates private key (n, d) and public key (n, e) and sends (n, e) to all soldiers. The soldiers wait for Alice's instructions every day, which is either "attack" or "don't attack". Alice sends encrypted message "attack" to the soldiers via RSA as ciphertext to all soldiers. Now suppose one of the soldiers is malicious and has hacked Alice's delivery method (e.g. email), but not her private key. And on a separate day sends the same "attack" encrypted cypher text to all other soldiers. What's to prevent this from happening (even if you use padding which will always result in decrypted message "attack")?

I suppose one way is to add a timestamp to all messages and soldiers must make sure the date matches with current day. But it still doesn't seem right that someone can send the same exact message to others by just having the cyphertext... Or am I missing something?
If Alice is sending the encrypted messages then her public key isn't involved at all. She encrypts the messages for each recipient's $(n, e)$ pair individually, and sends them tailored messages.

In reality she probably sends the message encrypted with AES and only uses RSA to send each recipient their copy of the decryption key, a la PKCS#7's EnvelopedData.

The recipients have no way of knowing that the message actually came from Alice in this scheme. What she needs to do is sign the message (post-encryption, for best results), which does use her private key.

At this point, as you observe, there's still a replay vector. So the message would need to contain some way of identifying its freshness. A monotonic time stamp is an easy way, a monotonic message counter is another, or some sort of pre-arranged keyword from a shared code book (if you like whimsey).

So the recipient does:


Verify the integrity of the ciphertext and encrypted key using Alice's public key. (Prove it was sent by Alice)
Decrypt/derive the message encryption key using their private key.
Decrypt the ciphertext to reveal the original message.
Verify the time stamp / counter. (Prove it isn't a replay)
Respond appropriately to the contents.


The time stamp could have been signed but not encrypted, it just depends on whether or not that is itself sensitive data.