# risk of attacker decrypting RSA ciphertext without public or private key

As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a simple symmetric encryption like AES-256. The answer to that question pointed out that using RSA to encrypt the symmetric encryption keys cannot make the solution any more secure. But since there are practical advantages I wanted to ask a further question:

When we say "RSA is broken" do we mean that a practical attack is discovered to retrieve the private key from the public, or do we mean that given a ciphertext and no knowledge of either the private or the public key the attacker can decrypt the data? I'm thinking that perhaps in my case the risk of the public key leaking from a trusted system that is doing the key-wrapped symmetric encryption is pretty small. And if by "broken" we mean the first alternative, and if we assume for a moment that the risk or the RSA public key leaks is zero (i.e. it's not public anymore) I am wondering if the more practical RSA+AES solution is for some reason actually less secure, rather than just equally secure, than the plain symmetric method.

Thank you!

-
Neither; we mean that a practical attack is discovered to get information about $\hspace{1.8 in}$ the data from the public key and the ciphertext. $\:$ –  Ricky Demer Apr 29 '13 at 7:19

When we say "RSA is broken" do we mean that a practical attack is discovered to retrieve the private key from the public, or do we mean that given a ciphertext and no knowledge of either the private or the public key the attacker can decrypt the data?

First off, we always assume the attacker has the public key. Someone saying "RSA is broken" could mean either. The first is a key recovery attack; the second is a message recovery attack. The second (finding $p$ from $c=p^e\bmod{n}$) is what is known as the RSA Problem. It just so happens that currently the fastest way to solve the RSA problem is to recover the private key (think factoring) and then recover the plaintext. It has never been shown that there doesn't exist a better way to find $p$ however (for more on this, see this question).

-
Thank you for your answer and the link to the question! –  kouk Apr 30 '13 at 11:43