First of all sorry if this question could be trivial, but I did some researches and it seems to me that this is a standard approach, but I want to be really sure.
I'm developing a signed/encrypted communication block channel. And, to encrypt/sign it, I chose the ECC.
Now, in order to send a message, I will do this
- Download the server's public key
- Generate an ECC key on the client
- Create the shared secret between the server's public and the client's private keys
- Calculate the hash of the shared secret (e.g. SHA-384)
- Divide the hash in two parts; one will be the communication key (e.g. 32 bytes for AES-256), the other the IV (if AES, 16 bytes)
- Encrypt the message with the appropriate algorithm and symmetric key
- Sign the message with the client's private key
- Send the client's public key, the encrypted message and the signature
Now, I have three questions about this:
- Is this approach secure or there is some naive issue?
- Is it better to sign the plaintext message or the ciphertext message? I'd sign the plaintext (so the server can verify if the message is correctly transmitted), but this would give the attacker a way to understand if the attack was successful
- What is the suggested ecc key size for this? If I calculate the SHA-384 of the shared secret, is the same ecc key size (so using curve P-384) a good choice? Should I use the biggest key possible (P-521)? Is even a smaller one enough (P-192)?