at my job we have been tasked by gov to encrypt some data we send to them. The "law" says we have to do the title above, but they only need us to do the AES256 thing because the data is not really that important. However, at any point they may change their mind and enforce the full specs so, not being into crypto I wanted to ask here for clarifications on my ideas.
I learned what "timestamping" is, but "digital certification" I'm assuming its those SSL things you buy to have verizon certify you are who you claim to be. I can create my own SSl certificate with apache, but I gather it is RSA not AES.
So would I have raw data>(Timestamping)>timestamped data>(AES256)>enc. tstamp data>(RSA private key)>result>send to gov?
then gov receives the result, uses the rsa public key, aes, and finally timestamp check?
Thing is, the certificate is supposed to be online or something so that the public key is public, so gov would just learn it, that's fine. But AES I read is symmetric, so we would have to agree on a password in secret, right? So they would probably give me the password to use or request it at some point. The timestamp would require us to agree on who is going to timestamp the data, or maybe I could send so they knew what public key to use when decoding the timestamp.
And those salts you add to data (passwords too?), I'm not sure where I'd add them, if I have to. Because it's gov, I'd like to assume we could end up in trouble, that secret AES passwords is probably going to be leaked at one point or another (by someone at gov, or some future unknown at my company), but then they could be used to harm the company/me? by forging fake data. Trying to think paranoid I'd end up salting everything I could whenever I could, but that's probably not how it's done.
Am I correct on my encryption pipeline? where should I salt? Where should I append data for decryption on the pipeline (If I add a salt do I have to append it to the data just like I would append the timestamper?) What should I do differently?