I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email.

I am no expert in crypto and need validation of this model. I intend to use crypto libraries and not cook anything myself, but there is enough leeway even when using libraries to shoot yourself in the foot, hence my question.

Here goes:

Each person will have an ECDSA key pair and an ECDH key pair generated at "account creation". The public keys are made available to the everyone by a trusted entity.

When the sender wants to publish secret content (plaintext) to the N receivers, the following will happen:

On the sending side:

  1. The ECDSA private key is used to sign SHA256(plaintext), yielding a signature.
  2. A random AES key K and IV are generated for that content.
  3. The plaintext is encrypted with K+IV (AES-CTR-256) yielding the ciphertext.
  4. For each recipient i<=N, the shared secret between the sender and the recipient is computed from the sender's ECDH private component and the recipient's ECDH public component. This shared secret is used as a key to encrypt K using a random iv IVi, yielding a "wrapped key" Ki

This process yields a "cryptobundle" set of { Ki, IVi} corresponding to recipient i.

Then the {ciphertext, IV, cryptobundle, signature} is sent through an unsecure channel to all N recipients.

This is what each recipient does:

  1. Compute the shared secret from their own ECDH private component and the sender's ECDH public component.
  2. Find their { Ki, IVi } pair in the crypto bundle (it will be keyed by their user id so they can easily find it)
  3. Run AES-CTR-256 to derive K from { Ki, IVi } + the shared secret (which is used as key)
  4. Use K + IV to AES-CTR-256 decrypt the cipher text back to plain text.
  5. verify SHA256(plaintext) with ECDSA public component of the sender.

Directed questions:

  1. Does this seem like a reasonable approach?
  2. Should the shared secret computed from the ECDH keys be used "as is" as a wrapping key, or should it be fed to a key derivation function to yield the key that will be used to wrap the content key K?
  • $\begingroup$ Please check ECDH from Wikipedia. Also use forward secrecy. And consider AES-GCM. Do you need signatures? $\endgroup$ – kelalaka Jan 16 '19 at 7:36
  • $\begingroup$ Do you need signatures? I see that you need authentication meaning the receiver needs to know that it was the sender (the public key) who sent it but does the receiver needs to prove this to someone else? If not then authenticated encryption is what you need where the signature will be replaced by a MAC. $\endgroup$ – lovesh Jan 16 '19 at 7:48
  • $\begingroup$ Secondly, if i understand your requirements correctly, you need ECIES (Elliptic Curve Integrated Encryption Scheme) for point 4 of sender, for symmetric encryption (point 2 and 3) you could use an appropriate authenticated encryption mechanism like AES-GCM. You can also look at broacast encryption $\endgroup$ – lovesh Jan 16 '19 at 7:49
  • $\begingroup$ Welcome to crypto.se - here is some advice about your question: Reviewing complete designs/protocols is considered off-topic here, so you will probably need to break the question up into parts that can be specifically answered. `Does this seem like a reasonable approach" is not a good format for our site; it is either opinion based, or asking for someone to find any/all vulnerabilities that may be present (depending on context). Advice regarding a solution: Look at existing protocols, and only design a new one if they don't provide what you need (and state in your question why they don't work) $\endgroup$ – Ella Rose Jan 16 '19 at 17:56
  • $\begingroup$ @EllaRose - thank you for your feedback. I apologize for my post not fitting the proper format. I perused similar posts and thought it was ok to formulate it this way. Perhaps they also were not appropriate. I will keep it in mind for further posts. $\endgroup$ – BearOverflow Jan 16 '19 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.