Re: Encryption question

["SERGIO OTERO" <SOTERO () gire com>]

You're describing a man in the middle attack. Using  digital certificates prevents this kind of trouble. Since the CA 
"authenticates" the certificate owner (i.e. Alice or Bob) and digitally signs the user certificate, you can't fake 
Alice nor Bob identity. 

Hope this help.

> > > "Preston, Tony" <Tony.Preston () acs-inc com> 24-02-04 04:01:29 >>>


Tony Preston
Systems Engineer, AS&T Inc.
Division of L3 Corporation
(609) 485-0205 x 181

I have what is a rather basic question...  I probably am missing something
so I thought I would ask here.

Alice and Bob both have a public and private key.

Alice encrypts her email to Bob using his public key.  Sends the email and
Bob decrypts it using his keys..

Since both Bob and Alice's public keys are known, Why can't I take Alice's
public key and create a key pair using any other private key.  Now, I fake
an electronic signature from Alice using the pair I created and send a bogus
encrypted message to Bob with my "fake" Alice signature.  Bob checks the
signature by using the public key and it is valid.   Bob assumes the message
is from Alice...

What prevents me from spoofing someone's electronic signature this way?



---------------------------------------------------------------------------
----------------------------------------------------------------------------



---------------------------------------------------------------------------
----------------------------------------------------------------------------