2
$\begingroup$

I'm designing a system where the client asked for documents to be encrypted with "asymmetric cryptography".

I've explained them that the best practice is to encrypt the data with a symmetric algorithm using a randomly generating key and then, using an asymmetric algorithm, to encode that key. The entire scheme is "asymmetric" but it uses multiple algorithms. I offered the usual performance/convenience arguments.

However they are insisting that we should only use asymmetric algorithms because they "have read that is better".

I'm preparing a note for them to better explain the topic and I would greatly benefit of official documents. I browsed the NIST, FIPS, RFC documents and so on but they are too wide to be used as a reference for a customer that is not well versed on this topic.

Does anyone have some pointers to authoritative sources that explain the best practices and that I could use to back up my arguments?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
1
$\begingroup$

The PGP, which is well known, uses what is in your mind, hybrid solution. Here a short documentation for your cause.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks, I'll surely use it as it gives a very clear explanation. Even if SANS is well known, I was hoping for something even more "official". $\endgroup$
    – Remo.D
    Sep 12, 2018 at 8:08
0
$\begingroup$

You're indeed looking for hybrid encryption. Shoup has a lot of papers on hybrid encryption and proposals for KEM/DEM approaches, for example this submission. It describes the motivation and security for such a framework.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks. I'll make use of that as well. in the meantime I've found a NIST document: dtic.mil/dtic/tr/fulltext/u2/a389360.pdf that provides guidelines on this aspect. Of course, the more I can add, the better. $\endgroup$
    – Remo.D
    Sep 12, 2018 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.