Hybrid encryption encodes payload with randomly generated key and symmetric algorithm, for example AES.
Random secret is typically short and can be encrypted with asymmetric algorithm, e.g. RSA. Review below diagram
for output data representation. To encrypt and decrypt content, users need to possess only key pair. Length of
initialization vector is dynamically calculated based on chosen symmetric transformation
(see
EncryptionHelper.ivLength(String, Cipher)).
Example configuration:
symmetric.transformation = AES/CBC/PKCS5Padding
asymmetric.transformation = RSA/None/PKCS1Padding
asymmetric.key.store.path = /tmp/keystore.jks
asymmetric.key.store.password = changeit
asymmetric.key.store.alias = key1
Output data representation:
+--------------------------------------------------------------+
| RSA encoded secret | initialization vector | AES encrypted |
| key used for AES | (optional, 8-16 bytes) | data |
+--------------------------------------------------------------+