I am working on a chat feature to use both post quantum cryptography along with RSA, and want to confirm my thoughts.
As these algorithms haven't been fully battle tested, I have decided to use a combination of both PQE and usual public, secret key cryptography
I decided upon the best algorithms to use for security.
- Signing: ED25519
- PQE KEM: McEliece
- NON-PQE KEM: RSA 4096
We are currently using McEliece's uniformly distributed entropy as a shared secret, but generating an AES-GCM key for use with RSA 4096 public-secret cryptography.
I have decided upon ED25519, as no candidates have been chosen for Round 4 signing as of 05/2023.
My current thinking is the following
Alice:
- Generate KEM keys
- Generate RSA keys
- Generate ED25519 keys
- Share public portions
Bob:
- Generate KEM keys
- Generate RSA keys
- Generate ED25519 keys
- Share public portions
KEM
- Run encapsulation using Alice's KEM public key -> cipher text #1, shared secret #1 (256-bit uniform)
RSA
- Generate 256-bit AES-GCM key #2 (shared secret)
- Encrypt ss #2 AES-GCM key using Alice's RSA 4096 n,e public key -> cipher text #2
Message
- Message: "Hello world!"
- Encrypt message using shared secret #1 (256-bit uniform / aes key)
- Encrypt message using shared secret #2 (256-bit AES-GCM key)
- Sign double encrypted message using Bob's secret ED25519 signing key -> signature
Send
- Double encrypted message
- Double encrypted message signature
- KEM cipher text #1
- RSA cipher text #2
Alice:
- Verify double encrypted message signature against Bob's public ED25519 Key
- Decapsulate KEM cipher text using Alice's secret KEM key -> shared secret #1
- Decapsulate RSA cipher text using Alice's secret RSA key -> shared secret #2
- Decrypt message using shared secret #2
- Decrypt message using shared secret #1
- "Hello world!"
My questions:
- Does the above look correct, or are there any changes you think would make sense?
- Is there an advantage to using RSA's encapsulate rather than encrypt?
- Should the message be encrypted twice as I assume, or does it make sense to encapsulate the cipher text output from one public-secret key cryptography algorithm?
