I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read the data. It is also required that the receiver can know for sure that the data comes from the sender.
The sender and receiver have a long-term business relationship, and will have exchanged public keys. The data files to be transmitted are not small.
I am assuming that Bouncy Castle is a good route to go, but I am open to other suggestions.
I have read all the BC documentation I can find (none) and look at the API and some examples I found on the internet. It appears that I want to be using
CMSEnvelopedDataGenerator, but I have some specific questions:
- Exactly how do I configure the data encryption (presumably using AES)?
- Exactly how do I configure the double-signing (using sender's private key and receiver's public key)?
- Can I configure it so that the data is zipped/compressed before being encrypted?
- Is the BC implementation of this scenario secure and safe to use? Are there specific settings/algorithms/parameters that are required to make it secure?
- Is there an available 3rd-party, standalone application that I can use to read/validate that the BC output is indeed correct and secure?
- What else should I be asking (I am a crypto newbie)? Or is there a better way to do what I am looking for?
Follow-up question In doing further research, I ran across this article. My requirements are such that I need to not be susceptible to surreptitious forwarding. The article is old. Do the various "secure" technologies still suffer from the mentioned faults? Do any of the standard products/libraries provide a secure solution in a standard way?