See:
https://secure.wikimedia.org/wikipedia/en/wiki/Session_key
https://secure.wikimedia.org/wikipedia/en/wiki/Ciphertext-on...
http://academic.csuohio.edu/zhao_w/teaching/Old/EEC693-S07/l...
See:
https://secure.wikimedia.org/wikipedia/en/wiki/Session_key
https://secure.wikimedia.org/wikipedia/en/wiki/Ciphertext-on...
http://academic.csuohio.edu/zhao_w/teaching/Old/EEC693-S07/l...
You create some random key K.
You encrypt k using the public key of the recipient, ie. e(k).
You encrypt the message using K.
You send both of those to the recipient. A cyphertext only attack can recover K from your message M. It is not then possible to recover a private key from K.
In neither case do you ever have the private key, as such it cannot ever be recovered from a core dump. In this script it seems like they are simply doing this twice, for some unknown reason.
* Parent commenter thinks messages should just use RSA, and not RSA+AES.
* You try to explain why he should use RSA+AES instead of RSA.
* He tries to post an analysis of why to use RSA-only.
Can I just step in to say: (a) using RSA only is way slower, like you said, and (b) it is significantly harder to make bulk RSA encryption secure than it is to make bulk AES encryption secure, just like you said?