I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server.
Key encapsulation: a 128-bit symmetric key is generated and asymmetrically encrypted.
Data encapsulation: a 96-bit IV is generated, the plaintext is encrypted with AES-GCM using the generated key and IV. The IV is prepended to the ciphertext.
The key is disposed of at the end of transmission and never reused. The response to the client is not a decipherment of the ciphertext.
It is my understanding that the encapsulated data portion isn't susceptible to padding oracle attacks by virtue of it being based on authenticated encryption.
I am concerned about key encapsulation, though:
1) is RSA-OAEP susceptible to padding oracle attacks?
2) if I were to use textbook RSA encrypt the concatenation of the key its MAC, would that be better or worse than RSA-OAEP?
3) which elliptic curve based asymmetric encryption scheme is adequate for my use case?
This 2001 paper(.ps) describes a variation on DHIES that provides PKAE (public key authenticated encryption).
The scheme is called DHETM:
1) A shared secret key is derived from client and server key pairs.
2) The key is halved into an encryption key and mac key.
3) We encrypt, then MAC
Any third party attempt to forge requests will almost certainly fail MAC verification.
Is this scheme accepted as secure?
Is this DLP/EC scheme preferable to RSA for the purposes I describe?
To sum things up so far:
1) Being based on DH, DHETM as I described it is indeed public key cryptography but can't really be considered asymmetric encryption -- The sender doesn't blind itself to the content of the message after encryption.
2) @CodesInChaos suggests (noise boxes)[https://github.com/trevp/noise/wiki/Overview] as an NaCl-inspired one-way encryption
3) @RichieFrame suggests encrypting a block-sized random message and forgoing padding. The symmetric key is derived by hashing the message down to the desired size. Is EC ElGamal adequate for this purpose?