Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.

To summarise, we generate a symmetric key and encrypt it using RSA. We would encrypt our data using the symmetric, and prefix it with the IV and encrypted key. You therefore need the private key from the RSA keypair to be able to decrypt the symmetric key and then decrypt the data using the symmetric key.

My question is about combining RSA with autheticated encryption, specifically AES in GCM mode. Are there any pitfalls, or any reasons this might be a bad idea?

Is it a good idea to include the IV and RSA-encrypted symmetric key in the additional data (to provide integrity for them), or should they simply be prefixed to the encrypted data?

share|improve this question
    
What security properties do you want? Anyone who knows your public key can send you a message with a valid authentication tag. –  Paŭlo Ebermann Apr 24 '13 at 19:58
    
@PaŭloEbermann Are you sure that's correct, as I don't see how that would work? The symmetric key used by AES would be randomly generated. It is only stored with the encrypted data after being RSA-encrypted. –  MurrayA Apr 24 '13 at 21:09
    
"The symmetric key used by AES would be randomly generated" by anyone "who knows your public key". –  Ricky Demer Apr 24 '13 at 21:25
    
@RickyDemer Ah, I see the problem now... doesn't the same problem exist for 'normal' hybrid cryposystems too? Is there a better way to do this? –  MurrayA Apr 24 '13 at 21:54
1  
Yes, but these don't pretend to be "authenticated". We actually have a weak kind of authentication, knowing that whoever sent your message actually knew the whole message, not only part of that. The classic solution would be to add an (asymmetric) signature to your message. –  Paŭlo Ebermann Apr 24 '13 at 22:01
show 3 more comments

1 Answer 1

up vote 3 down vote accepted

The main pitfall is possibly thinking that it provides authentication.
The result is still a public key scheme.

It won't help to include the IV in the associated data, since
that is already covered by the authenticated part of AEAD.

Including the RSA-encrypted symmetric key in the associated data would help by making the
resulting hybrid encryption CCA2 secure even if the core public key scheme is only RCCA secure.

RCCA: Relaxing Chosen-Ciphertext Security

share|improve this answer
    
I need to make the IV available somehow, whether it is prefixed to the data or stored in the associated data - is there any reason not to store it in the associated data? –  MurrayA Apr 24 '13 at 18:45
    
That would take slightly more computation. $\:$ –  Ricky Demer Apr 24 '13 at 19:07
    
So my understanding is that it is pointless to combine AEAD with RSA, because anyone with your public key can create data that will be verified as 'authentic'. Using a digital signature would prevent that, but then it is the signature providing the authenticity propery, not AE - so you gain nothing from combining the two. –  MurrayA Apr 25 '13 at 8:11
    
AEAD with some public key encryption is probably the best way to build $\hspace{2 in}$ public key encryption with associated data. $\:$ –  Ricky Demer Apr 25 '13 at 8:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.