I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings.
Assuming the machine where the creation and decryption of the file happens are secure, the threat is a passive (reading file) or active (manipulating file) attacker on the line.
These attributes must be granted:
- only decryptable by the intended receiver
- receiver can verify sender identity
- any manipulation to the data will be noticed by the receiver
So we need encryption, authentication, and a signature. After the study of this paper and several other, more basic principles, my protocol draft currently looks like this:
- the masterkey is random and used to derive HMAC and symmetric cypher key.
- IV is random and included inside the MAC.
- algorithm agility metadata is added inside the public key encrypted part to denote what hash is used for signing and MAC, and before the IV to transmit the symmetric cipher algorithm and mode.
- the recipient is identified by public key fingerprint.
What are the dangers or flaws I did not think of in this protocol?