I've started to read the section about the RSA cryptosystem in CLRS (page 958) and I don't understand the way it describes how to encrypt a signed message.
If Bob wants to send a message $M$ to Alice:
- Bob takes $M$ and encrypts it (using Alice's public key): $P_A(M) = C$.
- Sends $C$ to Alice.
- She decrypts it using her private key: $S_A(C) = S_A(P_A(M)) = M$.
If Alice wants to send a signed message $M'$ to Bob (page 961):
- She computes the digital signature of $M'$ (with her private key): $\sigma = S_A(M')$.
- Sends the pair $(M', \sigma)$ to Bob.
- Bob receives the pair and check the message authenticity by comparing $M'$ and $P_A(\sigma)$.
If Alice want to send an encrypted, signed message $M'$ to Bob.
In cursive is what I think (I don't know how) it goes.
- Alice first appends her digital signature to the message. I guess we get $M'' = M'\sigma$, where $\sigma = S_A(M')$.
Encrypts the resulting message/signature pair with the public key of Bob (the recipient): Is that $P_B((M'', \sigma))$? What does this mean: $(P_B(M''), P_B(\sigma))$ or $(P_B(M''), \sigma)$?. If the former, then what is the point of encrypting the digital signature?.
The recipient decrypts the received message with his or her secret key to obtain both the original message and its digital signature. I don't how this is done, since I don't know how steps 2 is performed.