1
$\begingroup$

this is a very top-level question - as I'm just starting to delve into crypto.

The main objective is to be able to communicate between 2 mobile devices through a BAAS server such as Firebase so that one app can notify another one and send data.

The data to be exchanged are encrypted image documents. Security is paramount since the images may contain sensitive data.

I will be using Ionic 3 to develop the apps.

So far I have tested the following technologies:

  1. Using WebCryptoApi in Ionic 3. I tested a few examples from WebCrypto Examples, and they tested ok on android.
  2. App to App communication (using Notification) using Firebase.

I plan to decode an image into Base64 (which is just a string) and use AES encryption/decryption.I plan to use the following simple workflow:

  • Case Scenario: User A requests file from user B:
    • User A creates key-pair and sends the public key to user B
    • User A keeps app open so that the private key is not stored anywhere.
    • User B encrypts the file with the public key
    • User B sends encrypted file to user A
    • User A decrypts user B's file

But Web Crypto does not seem to generate a simple AES Private/Public Key pair that enables me to encrypt/decrypt, as is the case with RSA-OAEP for example, where I can generate a public/private key pair.

AES-CTR, for example, only generates one key and uses a counter instead of a private key. But this counter is needed to encrypt as well, which makes my scenario not possible.

Is it possible to achieve my scenario with AES? If so, how should this be done? If not, what approach should I take?

I Appreciate any comments on this.

Improve this question
$\endgroup$

2 Answers 2

Reset to default
3
$\begingroup$

No, it is not possible to achieve this with AES.

AES is a block-cipher and AES-CTR is a symmetric encryption scheme. In particular, it is therefore not a public key encryption scheme, and there do not exist any public keys for it.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks @Maeher - can my workflow be accomplished with any other encryption scheme - Or what workflow can I adapt to achieve the same result using AES? $\endgroup$
    – dbertels
    Mar 5, 2018 at 3:37
  • 1
    $\begingroup$ You're using AES as some kind of magic trick to achieve security. It isn't. AES is just a block cipher. Using Web Crypto using RSA/OAEP might be the way to go; undoubtedly it will use AES as well to actually encrypt the messages (look up "hybrid cryptosystem"). $\endgroup$
    – Maarten Bodewes ♦
    Mar 5, 2018 at 14:01
  • $\begingroup$ Hi @MaartenBodewes - Thanks for the suggestion - I did try using RSA/OAEP before, and it worked - but it only encrypts small messages see my post on stackexchange on this. I have to encrypt files in the order of 2-8 MB. But the Hybrid Cryptosystem looks interesting. I will look into that. $\endgroup$
    – dbertels
    Mar 6, 2018 at 0:25
2
$\begingroup$

Thanks to @Maarten Bodewes for advising me to look into Hybrid Crypto.

I did manage to implement this using a Hybrid Crypto solution:

  • Use Symmetric Crypto to generate a session key and encrypt/decrypt plaintext
  • Use Asymmetric Crypto to encrypt/decrypt the Session key

A very helpful resource was Charles Engelke's 2016 workshop. There is a full implementation of Hybrid Crypto using the WebCypto in Lab 4.

The full workshop is worthwhile doing if you're interested in WebCrypto!

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.