I have been reviewing code for various internal apps that handle secure transmission of data with external systems. These follow the following process:
- RSA encrypt data with 3rd party public key
- RSA encrypt again using our own private key
- Transmit data
- 3rd party decrypts using our public key
- 3rd party decrypts again using their own private key
In this system we generate new private/public keys for each third party and all public keys are distributed securely and then kept private.
I don't understand why we would encrypt data using our own private key. I suspect the designer's intent was to enable verification that the data originates from us and that same person had no knowledge of signing messages to implement that instead. Unfortunately, that person is no longer around to be asked.
I am happy that our data is acceptably safe because we encrypt that with the third party key, but private key encryption seems sufficiently non-standard that I feel some discomfort. Is there anything that I should be concerned about?