I'm coding a very simple reverse shell in python, and I want to encrypt the communication between the server and the client. The idea is to exchange an AES key using RSA then use it to encrypt everything sent on the network.
Right now I'm trying to use PyCrypto's Crypto.Cipher.PKCS1_v1_5
module for RSA and it seems to work, but since I'm no expert in cryptography (I know the maths behind RSA but thats about it) I have no idea whether this is secure or not. The test code:
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
msg = 'attack at dawn'
key = RSA.generate(4096) # I know this is a huge overkill
pubkey = RSA.importKey(key.publickey().exportKey('DER'))
privkey = RSA.importKey(key.exportKey('DER'))
cipher = PKCS1_v1_5.new(pubkey)
ciphertext = cipher.encrypt(msg)
print ciphertext
dcipher = PKCS1_v1_5.new(privkey)
secret = dcipher.decrypt(ciphertext, 'thisIsForVerificationIfIAmRight')
print secret
The code works as expected. My questions:
- Is this a correct way to use this module?
- Is this secure?