AES encryption is a symmetric encryption, i.e., the secret key required for encryption and decryption is the same. The back-end generates a set of secret keys and encrypts the data using that secret key, then sends it to the front-end, which also needs to send the secret key to the front-end so that the front-end can decrypt it. This carries the risk that once the secret key is compromised, your encryption will not make any sense. Also, the benefit over RSA encryption is that it does not limit the length of the encrypted string.
RSA encryption, an asymmetric encryption, this is much safer compared to AES encryption. The back-end generates a pair of secret keys and takes the private key itself, and the public key can be made public. In this way, the front-end take the public key for encryption, the back-end take the private key for decryption, the private key in their own hands, the risk of being leaked is much smaller. Of course, there are also bad places, that is, the length of the encrypted string can not be too long, 1024 secret key can only encrypt 117 bytes or less of plaintext, which is more embarrassing, may be a little longer than the data will exceed, of course, you can extend the encryption length of the secret key through 2048 or 4096, but it will always be exceeded. So it is suitable to encrypt data that is not too long, preferably of known length, so that it will not report errors due to the length problem.
RSA+AES hybrid encryption, where the back-end generates a pair of public and private keys using the RSA algorithm, and provides the public key to the front-end. The front-end generates the key through the AES algorithm, encrypts it using the public key and sends it to the back-end, which decrypts it based on the private key and gets the same AES key as the front-end. Then, the front-end and back-end can use AES key symmetric encryption for data interaction.
The detailed steps are shown in the figure.
Hybrid RSA+AES encryption combines the advantages of both encryption methods. In addition, the front-end will randomly generate an AES key every time it starts, and the back-end adds a token invalidation mechanism (the front-end sets up a timed task to request a token), which increases the security of data interaction between the front and back ends.
blogs.com/huanzi-qch/p/10913636.html
/weixin_38342534/article/details/94582656