I need to verify that messages in a communications program are from valid senders. Below is a highlevel outline of how I think the process would work. The connections themselves are done over TLS. The process here is just using RSA signing/verification on top of that. The data itself is actually not that important so the extra AES encryption is somewhat redundant. Can someone confirm whether this is the general approach or set me straight if not?
plaintext = "Hello World!" #SIGN digest = SHA256(plaintext) sig = rsa_encrypt(sender_priv_key,digest) #ENCRYPT DATA iv = generate iv key = generate random key ciphertext = aes_encrypt(iv,key,plaintext) #ENCRYPT KEY encryptedKey = rsa_encrypt(recipient_pub_key,key) #SEND send(sig+iv+encryptedKey+ciphertext)
#RECEIVE sig+iv+encryptedKey+ciphertext = recv() #DECRYPT KEY key = rsa_decrypt(recipient_priv_key,encryptedKey) #DECRYPT DATA plaintext = aes_decrypt(iv,key,ciphertext) #VERIFY sigDigest = rsa_decrypt(sender_pub_key,sig) msgDigest = SHA256(plaintext) if sigDigest == msgDigest #valid sender so long as we can trust where we got the public key #data integrity is good