I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo-code the actions taking place are like this:

Alice's actions for sending a secret signed message to Bob:

AES = random()      
message' = encrypt(message, AES)
AES' = encrypt(AES, Bob's public RSA)   
messageHash = hash(message')
signature = encrypt(messageHash, Alice's private RSA)
send(Bob, AES')
send(Bob, message')
send(Bob, signature)

Bob's actions for receiving a secret, signed message from Alice:

AES', message', signature = split(input)
AES = decrypt(AES', Bob's private RSA)
messageHash = decrypt(signature, Alice's public RSA)
receivedMessageHash = hash(message')
messageHash == receivedMessageHash? --> bail out if unequal
message = decrypt(message', AES)

So, Alice chooses a random AES key, encrypts the message with it, and sends this to Bob, along with an encrypted version of the AES key to decrypt it and a signature to prove her as an originator.

Of course, there are other setups, like sending to multiple people or having no need for a signature or similar, but I'm looking for a kind of setup like this. Maybe I understand something wrong and my pseudo code above lacks precision or contains a bug. It just represents my crude understanding of the matter ;-)

I can do all this step by step by myself, using Python libraries like Crypto or Unix shell tools like OpenSSL.

But I'm looking for a standard way to do this, without worrying about how to implement paddings or that split() function used in the pseudo-code when receiving the message. I guess there must be a library or a toolset or whatever which does this for me and which may be even allowed interoperating with other programs doing similar tasks.


  1. Is my setup described above feasible and typical? Or does it contain any logical errors, flaws, or attackable aspects?
  2. Is there such a library or toolset available as Unix command-line tools or Python libraries that do this for me?

I'd prefer to stick to RSA and AES with an option of exchanging each with any other chosen algorithm, but solutions for a fixed algorithm set would be welcome as well.

As I said, sending from Alice to Bob is my first approach but being able to send to more than one receiver would be a nice bonus.

  • $\begingroup$ You might be interested in NaCl. (It uses different primitives, but the crypto_box C++ interface is about as foolproof as it gets.) $\endgroup$ – yyyyyyy May 8 '16 at 22:57
  • $\begingroup$ Sounds like there is no standard way of doing what I want besides the even more feature-loaded PGP and GPG. I would have assumed some kind of PKCS#whatever or similar is what I want. $\endgroup$ – Alfe May 8 '16 at 23:02
  • 2
    $\begingroup$ Well, there's CMS (also known as PKCS#7) which would get you close as well. $\endgroup$ – Maarten Bodewes May 8 '16 at 23:14
  • 1
    $\begingroup$ We don't encrypt with private key, even in an RSA context; we sign with private key. And $(\operatorname{hash}(M))^d\bmod n$ (which is what signature is) is not a robust RSA signature when $\operatorname{hash}$ is a standard cryptographic hash. $\endgroup$ – fgrieu Mar 14 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.