'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.
To summarise, we generate a symmetric key and encrypt it using RSA. We would encrypt our data using the symmetric, and prefix it with the IV and encrypted key. You therefore need the private key from the RSA keypair to be able to decrypt the symmetric key and then decrypt the data using the symmetric key.
My question is about combining RSA with autheticated encryption, specifically AES in GCM mode. Are there any pitfalls, or any reasons this might be a bad idea?
Is it a good idea to include the IV and RSA-encrypted symmetric key in the additional data (to provide integrity for them), or should they simply be prefixed to the encrypted data?