I am a beginner learning about encryption and I would like to ask a few questions, hoping this is the right place to ask, so please bear with me.
We have Alice and multiple clones of Bob. Only Alice can send messages to Bobs. Only Bobs can exchange messages with Alice, but not between each other. Alice and Bobs have met in person and exchanged keys and agreed upon the encryption algorithm. The amount of exchanged messages is small and they are small in size, so neither Alice nor Bobs care about the performance of encryption algorithm that much. Bob is a drunkard and might have revealed his key(s) to other parties at some point. If we assume that, in the worst case scenario, those other parties can impersonate Bob as well as interpret Alice's messages to Bobs, but not replay them or impersonate her, nor understand what other Bobs are sending Alice, the following questions come to my mind:
- Is it really necessary (and why) to exchange a symmetric session key, when neither Alice nor Bobs care about performance?
- Why don't they use public/private key pair for all of their communication?
- If the keys are shared beforehand, is it any less safe to use a single pair of keys instead of two (Alice in SSL land would have encrypted the message using her private key, and then encrypt the result of that with Bob's public key)?
Or, to put it simply, which functions from
openssl libraries are best suited for this purpose, if we are aiming for the most lightweight solution?