I've done research about this subject, but I can't find the answer I'm looking for.
The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during encryption getting
ValueError: Plaintext is too long.
The proposed solution is to do hybrid encryption by generating a secret key, sending the secret key encrypted with the clients public key, and then send the rest of the data encrypted using AES and the secret key.
I understand the performance is much better in this manner, but for me this feels like opening an extra door to the data. Even though no one would ever find my service interesting enough to try to decrypt the RSA or AES data. But now I have to trust and support two(!) algorithms for the client applications.
Everyone only seems to be speaking good about the hybrid solution, and I understand that it would be the best solution for anything with a lot of traffic going on. Since it's probably about serving users as fast as possible and its not good to waste resources on encrypting/decrypting data.
But theoretically the data is open to two attacks, either by brute-forcing the RSA and get the secret key to decrypt the AES, or directly by brute-forcing the AES. But then again, using 2048-bit RSA and 256-bit AES wouldn't be possible to brute-force any of them any time soon.
So the 256-bit AES must be harder than the 2048-bit RSA, else the data is now less secure somehow, but since AES is 'thousands of times' faster than RSA this doesn't feels true.
Guessing a 32-byte AES password seems easier than guessing the much longer private key.
How secure are they (AES-256 vs RSA-2048) relatively to each other?
The idea I have is that I split my message into chunks, and encrypts each one of them using RSA, then concatenate them into one packet, and the client can then read each encrypted chunk and decrypt them and then concatenate them back to the original message.
Other than it's slower than a hybrid method, Is there anything wrong with this approach?
How much slower it would be to use RSA in this way relatively to AES? For a 512B string and a 2kB string? Or if the speed is constant, the answer expressed in MB/s
PS: Now you don't need to bother and fight about the protocol, which I happened to explain earlier. I just thought the background would help you to answer the question easier, but instead more comments and downvotes on the wrongs in the protocol than the real questions.