Secure communication using encrypted messages

Question

I have a question about how to encrypt messages between users. Note i will only talk about cryptography theory and not platform dependent code like C++ with Windows Cryptography. I am talking about system programming and not web programming encryption with TLS, SSL, etc...

Also, ignore Certificates and Signing of messages, so just think of the Public keys as already being verified as not fraudulent and messages as being from the correct user.

I believe the best way to reach fast and secure encryption communication between users is to have both users with a session key because symmetric encryption is faster than asymmetric, and using asymmetric encryption (RSA) for the secure transfer of the session key.

I know there are other key agreement algorithms like Diffie-Hellmans, but lets stick with RSA which is what i've chosen.

Please tell me if you see where this might be a insecure (man-in-the-middle attack) or drastically inefficient way of performing encrypted communications.

Theory steps:

i.) Parties = {Server, Client}

ii.) Server: Generate session key (RC4)

iii.) Client: Generate private/public key pair (RSA)

iv.) Client: Send public key to Server

v.) Server: Encrypt session key with Client's Public Key, then send encrypted session key to Client

vi.) Client: Decrypt session key using Client's Private Key

vii.) Both parties now hold the session key for fast encrypted communications

Server(Server's Session key) <--> Session Key's encrypted packet (Communication medium) <--> Client(Server's Session key, Client's Public/Private key pair)

Thanks!

Answer 1

Assumptions:

• Public Key Tampering is not possible.
  • I think you mean this, by "ignore Certificates and Signing of messages"
• Cryptosystem is not broken.
  • Symmetric cipher is not broken (RC4 is broken, for example)
  • Asymmetric cipher is not broken
  • One-way Hash function is not broken
  • Random number generator is not broken

Under these conditions, that's perfectly safe. In fact what you described in your question is how PGP works.

If you are willing to learn more about attacks against PGP, go here. And if you are willing to learn basics of cryptology, this is an excellent beginner tutorial.