Question: What is the difference between "EncryptAndSign" and first Sign, then Encrypt using the separate methods about pgpcore HOT 4 CLOSED

Hi,

It's pretty much the same thing however it's more efficient to use the EncryptAndSign method as you can verify the message without having to decrypt it first. I'd suggest doing this if possible.

from pgpcore.

Thank you for your reply @mattosaurus!

How can the message be verified without decrypting?

From the README:

"Although this method is called EncryptAndSign the signature will actually be included within the encrypted message rather than being appended to the encrypted message. This ensures that the original message was composed by the holder of the private key."

If the signature is included within the encrypted message, doesn't this message need to be decrypted before verification?

from pgpcore.

Hi, apologies, yes you're right. I'm on holiday at the moment and haven't looked into the code for a while so had forgotten how this method works!

The advantage comes from being able to decrypt and verify the message in a single operation rather than needing to first decrypt it and then verify it in two separate operations.

from pgpcore.

Hi @mattosaurus , thank you for your reply! I'm still running into some Verify issues, but I'll create a separate issue for that. Enjoy your holiday 😁

from pgpcore.