Protocol Failures Related to Order of Encryption and Signature Computation of Discrete Logarithms in RSA Groups

摘要

In [2], Anderson and Needham describe the kernel of a general attack against protocols that encrypt before signing. The Anderson-Needham attack allows the receiver of an encrypted, signed message to take the sender's valid signature and forge another message for which the signature remains valid. In this paper, we complete the attack for the case where RSA [11] is the encryption algorithm, extend its application, and discuss practical issues related to implementation.