How to encrypt http response using RSA encryption

Question

I am developing a web service for which I am using RSA encryption to encrypt request-response. I have shared the public key with the client and I am able to decrypt the incoming request using my private key. Now my question is how can I encrypt the response which is to be returned to the client. I have two options for this:

(1) Use my private key to encrypt the response and client will decrypt it using already shared public key.

(2) Ask clients to provide their public key and encrypt the response with that public key.

Kindly suggest which strategy to use for encrypting response?

There is an easy button that does all this and more for you. It's called TLS/SSL. All you need to do is run your service over https. — President James K. Polk
– President James K. Polk, Commented Feb 3, 2020 at 13:12
Is this some kind of assignment? Becase as @JamesReinstateMonicaPolk rightly said, SSL/TLS is used for the same purpose. Why should one re-invent the wheel! — Kris
– Kris, Commented Feb 3, 2020 at 13:14
But is not SSL/TLS is different in the aspect that it uses symmetric encryption? — Jawad Tariq
– Jawad Tariq, Commented Feb 3, 2020 at 15:40

Maarten Bodewes · Accepted Answer · 2020-02-03 14:20:37Z

2

You cannot encrypt with the private key, as the public key is supposed to be public. Encryption with the private key is inherently unsafe and programming API's generally disallow the use of it.

So (2) is really the only option: have the clients public key and let them decrypt with the private key. However that's not all of the story:

the public keys need to be trusted, and you may need to setup a full PKI to trust the keys;
larger messages cannot be easily encrypted with RSA, so you may need hybrid encryption (encryption of a random AES key and encrypting the messages with that);
padding oracle attacks are very real, and do apply to RSA, so just performing RSA is pretty dangerous.

This is why it is generally advisable to rely on TLS (only). TLS is not always secure, but it is almost always more secure than a self-made scheme.

answered Feb 3, 2020 at 14:20

Maarten Bodewes

94.6k15 gold badges169 silver badges289 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Jawad Tariq Over a year ago

Thank you for taking your time to answer the question.This has helped me to understand the problem better and to reach to a conclusion. Hopefully, that will also be helpful to many out there.

Collectives™ on Stack Overflow

How to encrypt http response using RSA encryption

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related