Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply needs the user name and expiry time (will likely be very short), because they have access to check, against our user store, if certain users are valid.
My plan is to use some sort of AES/RSA combination to do this. I have a certificate that I could pass, in private communication, to them for RSA decryption. Maybe do the following:
- Encrypt required info with RSA (using certificate)
- Encrypt this information with AES (append initialization vector to the end)
- Pass this to the third party
- Have them decrypt using the IV and private key I will give them (passed in private communications)
- Have them decrypt using RSA and the certificate
Am on the right track here?