I am trying to wrap my head around Digital Signatures and how RSA Encryption supports them. And which order to do them along with what specifically to encrypt.
So say we have Alice and Bob and a Secret message M
Alice has: Bob's Public Key(B_pk), Alice's secret key (A_sk), Alice's Public Key (A_pk)
Bob Has: Bob's Public Key(B_pk), Bobs's secret key (B_sk), Alice's Public Key (A_pk)
- Alice generates a SHA256 hash of the message M. SHA256(M)
Encrypt the resulting hash with Alice's secret key using RSA. C1 = RSA(A_sk,SHA256(M))
Then Encrypt M with Bob's public key. C2 = RSA(B_pk,M)
Send C1 to Bob
- Send C2 to bob
- Bob gets C1, Decrypts with Alice's public key resulting in SHA256(M)_received
- Bob gets C2, Decrypts with his secret key, resulting in M_received
- Bob then runs SHA256(M_received) and checks if SHA256(M_received) == SHA256(M)_received
Are there any flaws in this method? Is Confidentiality, Integrity, and Authenticity protected?
Update: I am curious as to what the weaknesses are in the above method.