I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And for a double security, we are encrypting this main key again with another key (this time it is using a key which is hardcoded in the code itself).
Excuse me if I don't use sentences that make any sense for you, as I am new to this sector. I just have this legacy code and the way of using 3DES doesn't make any sense for me. It's not secure, we have a hardcoded key in our code and I didn't like the way 3DES is used here. Because the whole thing is based on symmetrical encryption.
Therefore I'm said that we should use RSA and they hand out me a design plan how to implement RSA along with 3DES. They came up with this design (they said they invented this design and it's the only way to do this):
- Create a random 3DES key every time
- Encrpyt the data with this key
- Encrypt the key used for 3DES with RSA and prepend it to the data block
- Decrypt the prepended data with client's RSA public key to get 3DES key
- Decrypt the remaining datablock with 3DES key
I've asked for the meaning of using two different encryption algorithms together (RSA and 3DES). I asked why we didn't just use RSA for the whole thing instead of using two different algorithms and combining them.
They said encryption of the whole data would cost more and is expensive (in term of performance). However if we just encrypt the key itself and prepend it to the data, then it will not using much performance because this time the data itself is small(before we encrypt the whole data, but this time we only encrypt the key).
Now, is the new design approach the correct way doing this? Or is this nonsense crap and the best way is to implement it RSA-only. What is the best way to implement a secure data communication? Or any way i could fix the previous way to make it more secure?