rather than forming the question by the techniques I'll describe the use case:
I'm persisting blocks of sensitive binary data in a remote store, the communication is secure (lets assume), but the store may not be.
- The data needs to be sent and stay encrypted on the remote store - it doesn't get decrypted immediately, just stays encrypted until some time when it's needed.
- The data needs to have proof that it was not altered
- The data needs to have proof that it came from the source
- block i+1 should have proof that it is the following block of block i
Putting the last requirement aside for a sec, what I have in mind it the following:
- Encrypt the data with the user's private key (for authenticity)
- Encrypt the data with the server's public key (for encryption) with symmetric encryption
- MAC the ciphertext for integrity
- Send the encryption + MAC
Thoughts about the above:
While I think it has the desired security properties it's an awkward use of symmetric encryption - as the data is not immediately decrypted on the other side, but instead remains encrypted for a long time which will require saving the symmetric secret for a very long time - which I think is not the typical case.
If I just replace AES symmetric encryption above with encryption with the server's public key - I'm not sure this preserves the security properties of the MAC then encrypt.