I wanted to ensure confidentiality by encrypting some information. I
also wanted to maintain non-reputability by encrypting huge data with
the senders
private RSA key.
Here the data is first encrypted with Senders(lets say A)
private key and then Recievers(lets say B) public key.To decrypt, 'B' is
the only one who can decrypt the data, and he knows the data came from
'A' because A's public RSA key is also needed.
string = "Simple encryption example message hope some one may help, lets
hope for better."
#[Here the string may be huge data like a file also, for that i changed
the below line to first_encrypted =
sender.private_encrypt(File.read(string)) ]
An RSA key can only encrypt data of a certain size, related to the key
size. What you want to do is not what you are doing.
RSA is rarely used to encrypt data directly. Instead, a symmetric key
(AES, 3DES, or other secure algorithm) is used to encrypt the data
using a randomly generated key, and then that key is encrypted with
RSA.
Might I suggest you stop doing what you are doing, and find a gem or
other utility that does what you want it to do, and not write your
own? Chances are you will get it wrong.
I wonder if you are mixing up public key and private key concepts.
A sender uses a public key to encrypt data, and a receiver uses a
private key to decrypt data.
Excuse me for being blunt but, clearly you have no idea what you're
doing regarding crypto, so unless you like introducing major security
vulnerabilities by miss-using RSA, AES, etc I can not recommend
strongly enough you stop what you're doing and follow two simple
rules:
1) Use TLSv1 for secure network communication between hosts
2) Use PGP for securely encrypting files
People like to think "I used <insert name of well known encryption
algorithm here> so I'm secure now" without understanding how easy it
is to screw up. And no, reading a book like Applied Cryptography
doesn't magically make you a crypto expert who can now avoid these
mistakes. RSA especially is easy to use incorrectly and reduce its
security to virtually nil.
You would store the key(s) on disk- just like the OP. Usually this
is done in the PGP keyring.
Who's key you would use depend on who you're encrypting the file to &
who you are signing it as.
Basically, PGP was made specifically for this use case. I can use
PGP to encrypt a file to Jack (using Jack's public key) and sign it
with my own private key so that Jack knows for certain that I sent him
the file and nobody in between made any changes to it.
I don't know if ruby has PGP bindings or not, but you can always fall
back to system().
