I'm not very experienced in the security field, but I'm trying to sign then encrypt a large folder in order to deal with software updates in some machines that will be offline. I've thought about generatic a key pair which my company will keep in secret and will be deployed in each of the machines. I've used this commands in order to generate the key pair:
openssl genrsa -des3 -out private.pem 2048
openssl rsa -in private.pem -outform PEM -pubout -out public.pem
Now I'm writing one script in order to zip one folder, use aes-256 symmetric encryption with a random password over it and then sign and encrypt the password using my newly generated keys:
#!/bin/bash zip update.zip update/* #Generate a random password openssl rand -hex 16 > symmetric_keyfile.key #Encrypt the file with the random password openssl aes-256-cbc -a -salt -k symmetric_keyfile.key -in update.zip -out update.zip.enc rm update.zip #Sign the password with the private key echo 'Signing...' openssl rsautl -sign -inkey private.pem -in symmetric_keyfile.key -out symmetric_keyfile.key.sign #Encrypt the password with the public key echo 'Encrypting...' openssl rsautl -encrypt -inkey public.pem -pubin -in symmetric_keyfile.key.sign -out symmetric_keyfile.key.enc #Zip both files zip update.zip symmetric_keyfile.key.enc update.zip.enc
However I've got this error while encrypting:
adding: update/deploy.zip (stored 0%) Signing... Enter pass phrase for private.pem: Encrypting... RSA operation error 140035711579800:error:0406D06E:rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size:rsa_pk1.c:153:
I guess it's related with the signed key being to large to be encrypted. The size of it is 256 bytes. Any ideas?