DSACryptoServiceProvider vs. RSACryptoServiceProvider

Question

I seem to have misunderstanding here.

I need to implement public/private key encryption (PKCS) with digital signing. I've found the following classes in .Net framework.

1. RSACryptoServiceProvider
2. DSACryptoServiceProvider

I want to encrypt files then digitally sign them, and at the receiver verify the signature and then decrypt.

The class DSACryptoServiceProvider has the function VerifySignature which takes both the signed signed value and the un-signed value!

My question here is whether to encrypt-then-sign or sign-then-encrypt?

If i send the un-signed key (along with the signed key) of the encryption key, then any third party will be able to decrypt the text

Answer 1

You always encrypt then sign. Doing it this way means that the receiving party can check the encrypted data has not been changed during transmission without having to unencrypt, which can be a lengthy process.

Answer 2

Signing means:

1. Sender calculates a hash from the data before sending

2. Sender encrypts that hash with senders private key

3. Receiver calculates hash from the received data

4. Receiver decrypts senders signature with senders public key

5. Receiver compares the locally calculated hash and the decrypted signature

I suppose VerifySignature() does steps 4) and 5)

In steps 1) and 3) you create the hash for the encrypted or unencrypted data, your choice as long as sender and receiver do it exactly the same.

Note that this is independent of the actual encryption of the data, you can even sign unencrypted data. Also note that the use of the keys is reversed, normally you encrypt with the receivers public key.

Answer 3

Just to clarify some possible confusion (but maybe it is obvious):

1. You don't encrypt the message itself using an asymmetric algorithm - something like AES is probably more appropriate.
2. You send the encrypted message and the hash (the hash is encrypted). The recipient generates the hash themselves and checks that it matches the hash you sent (that they have decrypted using the senders public key).

If you don't have a shared key to use for the symmetric encryption (i.e the encryption of the message itself) then you probably should generate one and encrypt it with the recipients public key and send it along with the signed message.