20.8.2 Plausible Deniability Based on Public Key Technology

How can Alice send a message to Bob in such a way that Bob knows it came from Alice, but Bob cant prove to anyone else that it came from Alice? Alice can send public a public key based repudiable message m to Bob by doing the following.

First well review our notation. We use curly braces { } for encrypting something with a public key, with a subscript specifying the name of the individual whose public key we are using. We use square brackets [ ] for signing something with a private key, with a subscript specifying the name of the individual whose private key is being used.

Alice picks a secret key S, which she will use just for m.

She encrypts S with Bobs public key, getting {S}_Bob.

She signs {S}_Bob with her private key, getting [{S}_Bob]_Alice.

She uses S to compute a MAC for m (for example, by using DES to compute the CBC residue of the message).

She sends the MAC, [{S}_Bob]_Alice, and m to Bob.

Bob will know that the message came from Alice, because Alice signed the encrypted S. But Bob cant prove to anyone else that Alice sent him m. He can prove that at some point Alice sent some message using key S, but it might not have been m. Once Bob has the quantity [{S}_Bob]_Alice he can construct any message he likes and construct an integrity code using S.

Suppose you changed the protocol in Kaufman & Perlman 20.8.2 Plausible Deniability Based on Public Key Technology so Alice first signs S, and then encrypts with Bobs public key. So, instead of sending [{S}_Bob]_Alice to Bob, she sends {[S]_Alice}_Bob. Written in the syntax of the textbook:

message M sent to Bob = (M, MAC, {[ S ]_Alice}_Bob)

Does this work? (i.e., can Bob be sure that the message came from Alice, but not be able to prove it to a third party?) Your response needs to include a justification with citations.