Messages - Rationale for signing and encryption order needed

[Michael Jones]

The spec currently says “When the message is both signed and encrypted, it MUST be signed first then encrypted.” Rationale for this order should be added to the spec.

[Nat Sakimura]

Noted.

This is a spec. and not whitepaper.

For people who has been working on dsig, it is obvious that otherwise it is not legally viable. Think of the case where encrypting the content with the receiver's public key first then signing over it. It is signing what the signer cannot see the content of. Thus, it is invalid as a digital signature. (It is only valid as MAC/Integrity).

[Michael Jones]

I'm fine with this being addresses with a line in the Security Considerations section.

[Nat Sakimura]

Add some explanation text right after the original clause.

[John Bradley]

Fix #344 Messages - Rational for signing then encrypting added to security

→ cb0a91de1a53

[John Bradley]

I added it to Security Considerations and referenced it, as it was in several places.