Maybe I'm dense but I can't figure out howto verify/authenticate encrypted files.
Is there something missing in the documentation.
Is there something missing in the documentation.
Specialized tools are simpler than one do-it-all tool.
> If you encrypt and then sign, an attacker can strip your signature, replace it with their own, and make it look like they encrypted the file even if they don't actually know the contents.
> If you sign and then encrypt, the recipient can decrypt the file, keep your signature, and encrypt it to a different recipient, making it look like you intended to send the file to them.
I might as well encrypt a message "add $10000 to my account" with the bank's public key, sign it with my own key and send it...