Question

When talking about asymmetric encryption it is often said that due to some reasons you should not encrypt your entire message asymmetrically, e.g. performance considerations.

The usually suggested workflow is:

• Create a random key for symmetric encryption
• Encrypt the message using this random key
• Encrypt the random key using asymmetric encryption
• Send the encrypted message and the encrypted key to the recipient

So far, so good.

Just two questions:

1. How do I send the encrypted message and the encrypted key in combination? Is there a standard for that? Or am I completely free on how to do this? (I’d prefer a standard if there is one).
2. Is there any best practice on how to create the random key? To be more specific: Is there a specific function in OpenSSL that should be used for that?

Answer 1

1. This was answered in comments. I would better recommend to check OpenPGP – it is somehow easier to understand, CMS has a huge ASN.1 structures overload.
2. Random key just should be completely random byte string, generated from good random source.