(Disclaimer: I'm an experienced server-side Java programmer, but with little crypto experience.)
I've got a login server which, given a login+password pair, should issue a unique auth token. Using the same login+password pair multiple times should issue new unique tokens, all of them should be valid at the same time. A token is a ciphertext that only the login server should be able to create. Everyone else should only be able to extract the payload from it.
First, I thought I should just use RSA to encrypt the payload with the private key. Other parties would just use the public key to decrypt it. But I read somewhere that RSA cipher doesn't provide integrity and authenticity so I figured I need to add an RSA signature, so it'd look like:
RSAcipher-with-private-key(payload-length + payload + RSAsignature(payload))
Then I discovered that the plaintext cannot be larger than the key size and thus I need a symmetric cipher, so I went researching on AES and stumbled upon GCM. As I understand, GCM solves the A. and I. problems, so I wouldn't need the signature anymore, and came up with that:
RSAcipher-with-private-key(AESkey + GCMiv) + AES-GCM-cipher(payload)
So the other parties would extract the AESkey and GCMiv using the public key, and then use that to decipher the AEScipher block.
I'm using BouncyCastle java library, since some people say AES/GCM in Java 1.8 is broken.
Will that work, is that secure, am I trying to invent a wheel here? If that's the case, what out of the box solution I could use?
GCMParameterSpecwhile Bouncy uses
IvParameterSpecapparently for compatibility with older JREs (which didn't have GCM) -- which is a perfectly sensible goal for BC that is not a goal for Oracle. (And all of which is implementation and only matters after you get the design right.) $\endgroup$