0

Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256.

A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv Iv.

An Hmac is produced using HMAC-256 with key AKey.

This is encoded as the following.

Salt . Iv . Ciphertext . Hmac

My question is, can I RSA encrypt key K and append it to the encoded string such that it remains secure?

Edit 1

I'm not entirely sure how to respond to Rory's comment, so I'll give my best shot.

By secure, I mean being able to transport this payload over the wire without having a third-party (without the corresponding private RSA key) able to decrypt or mutate the payload.

This approach may also be used for data at rest.

Improve this question
4
  • Hi there - welcome to Security.SE. Can you edit your post to describe what you mean by secure. It helps us answer if we know your threat/risk model, as some here are looking at protecting corporate intellectual property against nation state attack, others against a nosy neighbour trying to access a webcam, and everything in between.
    – Rory Alsop ♦
    Oct 2, 2018 at 16:55
  • 1
    So you want to symmetrically encrypt a message, asymmetrically encrypt the key, and transmit both together without risking confidentiality/integrity of the message?
    – user8675309
    Oct 2, 2018 at 17:49
  • 1
    I'm looking to send the asymmetrically-wrapped key along with the message. The receiving server will contain the private key necessary to decrypt the key, which it will then use to decrypt the message.
    – s.ribich95
    Oct 2, 2018 at 18:00
  • You're describing basically how PGP works, so I'd say yes it's generally considered a secure method of communication and protection at rest. That being said I'm far from an expert, so take anything I say with a grain of salt.
    – user8675309
    Oct 2, 2018 at 18:54

2 Answers 2

Reset to default
1

Yes, you can send an encryption key with any crypto algorithm as long as you apply the necessary security requirements.

For example; there is a small encryption exponent problem in RSA, to cope with it you have to apply some padding as stated in PKCS#1

note: Storing the RSA private key securely is equal to storing the 'K'?

Improve this answer
1

By secure, I mean being able to transport this payload over the wire without having a third-party (without the corresponding private RSA key) able to decrypt or mutate the payload.

No. An attacker could create their own K' and Salt', repeat the entire process you describe from scratch, replace your encrypted message with theirs, and the recipient would be none the wiser. Your Hmac is based on AKey, which is derived from K, but by assumption, the recipient does not know K nor AKey, so the attacker can just generate a brand-new Hmac' from their AKey', and it will look legitimate.

The correct way to fix this is for the sender to sign the message using an asymmetric key not derived from K. This means the sender needs its own private key in addition to the recipient's public key, and the recipient must know and trust the sender's public key.

Improve this answer
1
  • This is correct, but just to be clear: if the attacker needed to preserve part of the original message (because they didn't know its contents but the recipient expected it and it needed to be correct), they wouldn't be able to modify any part of the message (even if they know the content and offset of those parts) without invalidating the HMAC. However, if wholesale replacement of the message is a threat, then yes you need either a pre-shared key (for HMAC) or to sign the message (or at least one vital part of it, suck as K) using your private key and the recipient must have your public key.
    – CBHacking
    Nov 2, 2018 at 8:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .