Is this a Secure strategy for sending a large Encrypted Message using Hybrid RSA 2048, AES 256 and authenticated with HMAC SHA-256:
Given the Alice already has Bob's RSA Public Key, Alice:
- Generates a new 128bit IV (strong PRNG)
- Generates a new AES 256bit/CBC/PKCS7 Crypt Key (Kc)
- Generates a new AES 256bit/CBC/PKCS7 Auth Key (Ka)
- Encrypts her Message + Timestamp with (Kc) and IV => (M)e
- Authenticates IV+(M)e with (Ka) using HMAC SHA-256 => IV+(M)e+Tag
- Encrypts (Ka)+(Kc) with Bob's RSA Public Key padded with OAEP => (Kc+Ka+P)e
- Authenticates (Kc+Ka+P)e with (Ka) using HMAC SHA-256 => IV+(Kc+Ka+P)e+Tag
- Sends Bob RSA Encrypted IV+(Kc+Ka+P)e+Tag and AES HMAC-256 Message IV+(M)e+Tag
Bob then proceeds to:
- Extracts IV from IV+(Kc+Ka+P)e+Tag
- Checks IV against nonce cache, rejecting messages with repeated IV's
- Extracts and Decrypts (Kc+Ka+P)e with his RSA Private Key => (Ka)+(Kc)
- Verifies IV+(Kc+Ka+P)e+Tag with (Ka), rejecting invalid messages
- Verifies IV+(M)e+Tag with (Ka), rejecting invalid messages
- Decrypts IV+(M)e+Tag with (Kc)
- Extracts Timestamp and Message
- Verifies Timestamp isn't older than Max Request Age, rejecting expired messages
Basically would like to know if there are any obvious weaknesses with the above Hybrid RSA/AES/HMAC SHA-256 approach or anything anyone would do differently?
The above strategy has been revised to include @puzzlepalace's feedback of creating separate AES keys for Encrypting and Authenticating instead of deriving them from the SHA-512 hash of the master key.
Any other feedback or suggestions for improvements are welcomed!