I wish to have my server encrypt messages to clients who have each provided the server with an RSA public key, as well as having the clients authenticate their messages to the server using their matching private key. Before starting development—to help me and the other developers understand what would be involved—I created toy scripts that performed each step using OpenSSL (v0.9.8zg July 2015).
When figuring out what the OpenSSL commands would be, I used this page as a reference, but it left me with two questions:
- Why is the generated key used for AES-256 encoded in Base64 prior to its use in AES-256 and its encryption under RSA?
Is it even safe to encrypt a 256-bit key without knowing how large the RSA key is? According to this answer, if it’s a 2048-bit RSA key, at most I would be able to use AES-192.(As pointed out by @AgentME, this was based on a misreading of that answer.)