# Weakness in using only one RSA key pair for two-way communication?

In Alice/Bob/Cindy terms (EDIT: and with a little more detail):

Alice and Bob have each securely obtained one key of an RSA keypair from a trusted third party. Alice has one key ($e$ and $n$), Bob has the other ($d$ and $n$, where $d\equiv e^{-1} (mod\ \phi(n))$).

The RSA algorithm technically does not care which of the two keys is used to encrypt and which to decrypt; if $c_1 \equiv m^e (mod\ n)$ and $m \equiv c_1^d (mod\ n)$, then $c_2 \equiv m^e (mod\ n)$ and $m \equiv c_2^d (mod\ n)$. ($c_1 \neq c_2$)

Therefore, Alice uses $e$ and $n$ to encrypt a message $m_a$ into ciphertext $c_a$ and sends it to Bob, who decrypts it with $d$ and $n$, then encrypts his response $m_b$ with the same $d$ and $n$, and sends the ciphertext $c_b$ to Alice who can decrypt it with $e$ and $n$. Thus, one pair of asymmetric keys is being used to form a two-way communication channel, instead of the normal one-way usage.

Now, Cindy does not know $e$, $d$, or $n$, or any artifact used to produce them, such as $p$ and $q$. she can only see $c_a$ and $c_b$ as they are passed between Alice and Bob. Given that all other security concerns with RSA are properly handled, such as $\geq$2048-bit keys and OEAP padding scheme, is there an "efficient" way (an attack) by which Cindy can obtain $m_a$ and/or $m_b$?

-
Would any padding be used? $\:$ –  Ricky Demer Dec 1 '12 at 1:42
How would that make a difference? –  KeithS Dec 1 '12 at 1:56
@KeithS: $\:$ It would affect whether or not the scheme is trivially insecure. $\;\;$ –  Ricky Demer Dec 1 '12 at 4:51
Your scheme is essentially symmetrical, so why would you use RSA over AES? –  CodesInChaos Dec 1 '12 at 9:24
@fgrieu - Cindy does not know any part of the keyset including the shared modulo. She does not know any plaintexts involved. All she can see are the ciphertexts passed back and forth. –  KeithS Dec 3 '12 at 19:14

The question and comments seem to be asking the following: If an implementation of RSA is used in the following way, is it still secure? An RSA modulus $N = pq$ and exponent $e$ are generated, and (N,e) is given to Party $A$ and $(p,q,e)$ is given to Party $B$. Then, the parties encrypt their communication where Party $A$ encrypts using the modulus and exponent, while party $B$ encrypts using the private primes and the exponent.