RE: weak authentication issue with rfc5083

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Daniel Brown <dbrown@xxxxxxxxxxxx> writes:

>This is a serious problem, imo.  If Bob receives an AuthenticatedData from
>Alice but it is not really from Alice, then there really is no
>authentication, despite the promise that AuthenticatedData provides
>authentication.  What security service is AuthenticatedData providing in this
>case?

Maybe it would have been better to call it IntegrityProtectedData :-).  That's
actually the only thing I've ever used it for, my assumption was that you sign
email and you MAC stored data.

Peter.