(1) and (3), yes. (2) is not about process authentication but about using authenticated encryption that detects tampering.
More broadly, there needs to be a threat model that states what your attacker is capable of.
Even more broadly, I get the impression you’re not an experienced cryptography engineer and you didn’t work with one. Learning is great, but this is not presented with any warnings, which is irresponsible.
More broadly, there needs to be a threat model that states what your attacker is capable of.
Even more broadly, I get the impression you’re not an experienced cryptography engineer and you didn’t work with one. Learning is great, but this is not presented with any warnings, which is irresponsible.