I was tasked with writing a small Java console application that involves encryption. I am not familiar with encryption, so I had to do some reading up first. So far the high level requirements given is that AES-256 should be used to generate a one-time key to encrypt a file.
After that, the recipient's public key (RSA-2048) should be used to encrypt that AES-256 one-time key. The encrypted file and the encrypted one-time AES-256 key will then be zipped up and send to recipient.
From what I understand about encryption and decryption from reading up, apart from the algorithm (RSA, AES, etc), there is also things called mode and padding. For example, the following code specified RSA as algorithm, ECB mode and PKCS1Padding.
Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
The same algorithm, mode and padding must be used in the encryption and decryption. Therefore, is it reasonable for me to go ask the users on what mode and padding they want?
I notice that Cipher cipher = Cipher.getInstance("RSA") seems to use the default mode of ECB and padding of PKCS1Padding, and so this line of code is the same as the above. So is it ok to assume that ECB mode and PKCS1Padding mode will be used for RSA-2048 as default?