I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice addition, I would like to sign it (and, ideally, some additional data) with my public key

Parties do not communicate in any way prior to transferring the blob (except for them sharing their public keys), so various schemes involving DH or something similar do not fit in this scenario.

Obviously, I don't want to invent my own container for that.

What container do I use so that it allows me to use encryption / signing with industry-standard algorithms which don't have known flaws?

The obvious way would be to go with CMS/PKCS#7. Even the ideal scenario could be achieved by doing Encrypt-then-Sign with some manual arrays concatenating, like:

encryptedMessage = createEnvelopedCms(cleartextBlob, recipientPublicKey)
signedMessage = createSignedCms(authenticationData.Length + authenticationData + encryptedMessage

However, CMS has two significant drawbacks:

1) It seems that it only can be used with RSA/DSA/ECDSA keys, and of these three, only RSA can be used for encryption. However, RSA is not futureproof (as it is not quantum-safe).

2) It seems that CMS only supports AES in CBC mode, which also has its flaws.

Then there is GPG container, but I cannot find information on what specific algorithms it uses, and it does not seem to be configurable to the same extent as CMS.

If I was inventing my own container (which I'm not), I'd probably do something along these lines: generate random AES key + IV; encrypt blob using these in AES-GCM mode (adding the required authentication info); encrypt AES key and IV using recipient's ECC public key; concat encrypted keys + authentication info + encrypted blob and pack these in a CMS message signed by sender's ECDSA key. Is there any industry-standard container which would allow me to do all this?

  • GnuPG implements OpenPGP, which is specified in RFC 4880. While the special OpenPGP CFB mode is fixed, you're can pretty well choose among the other algorithms.
    – Jens Erat
    Jul 15, 2017 at 17:47

1 Answer 1


RFC 5084 solves the issue of using AES in GCM mode within a CMS message. And the CMC specified by RFC 5652 does not restrict you from using any public key algorithm.

  • Thank you for RFC 5084 reference. Unfortunately it is not implemented yet in BouncyCastle, but OpenSSL support wiki.openssl.org/index.php/Manual:Cms(1) is enough for me at this stage. Could you please clarify what algorithm (for example) I can use with X.509 and CMS encryption besides RSA? I've just checked, and X.509 certificates created with openssl req -newkey ec:whatever are only usable with ECDSA and ECDH per their documentation wiki.openssl.org/index.php/Manual:Req(1)
    – penartur
    Jul 15, 2017 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .