# Why is RSA usually limited to messages up to 1 block

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution of choice e.g. c.f. Bouncy castle FAQ.

I know about the advantages of hybrid encryption considering

• better performance
• efficient handling of multiple and changig recipients

Are there any other reasons not to use only RSA?

-
The advantages you cite are very significant. Any other potential advantages would be dwarfed by these. – mikeazo Jan 8 '13 at 17:41
If you encrypted the whole thing with RSA, the ciphertext would also be quite a bit larger than the plaintext, because of per-block padding. – Thomas Jan 8 '13 at 17:49
possible duplicate of Why is asymmetric cryptography bad for huge data? – Ilmari Karonen Jan 10 '13 at 0:41
– Gilles Jun 5 '13 at 12:26

We do not really know how to do RSA encryption of messages which span multiple blocks. At least not securely. The problem is already hard for block ciphers (see all the defined modes of operation).

Also, the worst performance issue with arithmetic cryptography like RSA is not about CPU, but about size. When you encrypt a piece of data with RSA, you get some overhead. E.g. with a 1024-bit RSA key, you can encrypt at most 117 bytes at a time, but this yields 128 bytes. When transmitting a long message, a fixed overhead of a few hundred bytes is much more tolerable than a +10% size increase.

CPU efficiency is often quoted as the reason we do hybrid encryption, but it is rarely as compelling as the two problems explained above.

(Additional point: since proper RSA encryption needs randomness, you must have a cryptographically strong PRNG -- also known as "a stream cipher". So even non-hybrid encryption does not avoid using symmetric primitives.)

-
One could probably construct modes that only need randomness for the first block in an IV like manned when using a chained mode. But there is little reason to put in the effort to design such a mode that still will be much worse than AES. – CodesInChaos Jan 8 '13 at 18:47
I understand the general problem of message overhead. – Thomas Lieven Jan 9 '13 at 12:25
As far as I know the gain of a cipher from plain text to cipher text is called stretch factor. For a probabilistic cipher this factor is compulsorily larger than 1, i.e. the cipher text of a probabilistic cipher will always be larger than the corresponding plain text. So a +10% size for a probabilistic cipher does not sound that much for me. – Thomas Lieven Jan 9 '13 at 12:34
@ThomasLieven For block ciphers with mode of operations using an initialization vector, we can get away with a fixed overhead (i.e. stretch factor converges to 0 for long messages), and still get a probabilistic cipher. – Paŭlo Ebermann Jan 9 '13 at 20:23