After learning about symmetric encryption, public-key encryption, one-way hash, digital signature and digital certificate, I was tasked to think of an imaginary hybrid cryptosystem. I was thinking along the lines of this:
- Alice and Bob agrees on a shared private key that is to be used to encrypt (using encryption algorithm like AES) messages
- To reach private key agreement, Alice and Bob will use DH
- Alice now wants to send the message p to Bob
- To ensure that Bob can verify the message p comes from Alice, Alice will sign the message p.
- Because signing requires a lot more resources and can only typically only sign a message with a limited amount of length, Alice will first hash (say using SHA-1) then message p to a message digest called md1. The message digest md1 is then signed by Alice (using some signing algorithm like RSA). This message digest md1 now contains a digital signature and will be called s
- Then, Alice will send both the original message p and the signed message digest s after encrypting them using an encryption algorithm (say AES) using the private key that was agreed upon during DH. Alice also sends the required information in regard to verifying the signature.
Now the message sending process is done. It's Bob's turn to receive the sent packages:
- Bob will receive and encrypted original message p and signed message digest s
- With RSA, Bob can convert the signed message digest s back to message digest md2
- To verify that the message has not been tampered with midway, Bob will now hash using the same hashing algorithm (in this case, SHA-1) from the sent original message p to create another md3
- Bob then checks if md3 and md2 are the same or not. If they are, they are from Alice. If they're not, Bob will ignore this message
- Bob has now received the original message
I was thinking along the lines of the above, but some points went over my head.
- Bob magically knows that the algorithms used are SHA-1, RSA and AES. How do Alice and Bob agree on the algorithms used in the whole process?
- When I'm hashing and signing, I'm providing integrity and authentication at the same time. Are these two processes inseparable if I want to provide both aspects? I'm assuming that you always sign the message digest because of efficiency problems (as mentioned above), is this correct?
- The very first step of DH is to exchange a public key generated by Alice and Bob. To do that, they will need to agree on an initial large prime number pn and its prime generator g. Then, I will send the public key generated by both sides. However, as I will be exchanging messages, how do I know that the agreed pn and g are not tampered by others and that the public key sent from both sides are indeed from themselves and not an attacker? Do I need to sign these message exchanges?
- As you can see in my example, I have failed to involve a CA in my imaginary hybrid cryptosystem. In my understanding, a CA will verify that messages are indeed from a company/person. To verify the messages are from one side, CA will see the digital certificate that is sent alongside the message. However, why do I need to involve a CA when I can sign a message myself and ask the receiver to verify the signed message? Why involve a third-party?