7
$\begingroup$

I've been familiarizing myself with the basics of PGP. If I understand correctly, PGP symmetrically encrypts the data of interest using a random single-use key, then encrypts the encrypted data and its symmetric key using the public key of the intended recipient.

What benefit does the inner layer of symmetric key encryption provide? I am having trouble understanding how this layer adds security over simply encrypting the data with the recipient's public key straight away.

Improve this question
$\endgroup$
1

3 Answers 3

Reset to default
12
$\begingroup$

I think you misunderstood a detail of PGP encryption. Only the random symmetric key is encrypted under the recipient's (asymmetric) public key. This way to encrypt stuff is quite common and is called KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method oy Hybrid Encryption. Some refs: en.wikipedia.org/wiki/Hybrid_cryptosystem and en.kryptotel.net/encryption.html.

Improve this answer
$\endgroup$
11
$\begingroup$

A PGP encrypted message can be hundreds or even thousands of bytes. Encrypting and decrypting large amounts of data using asymmetric algorithms is extremely slow. Encrypting only 32 to 16 bytes (the symmetric key) is much faster.

Additionally, if you encrypt the same message twice with an asymmetric algorithm, you will get the exact same ciphertext. Using a symmetric algorithm with new random keys makes each message indistinguishable from eachother.

Improve this answer
$\endgroup$
3
  • 3
    $\begingroup$ Just to quantify, a modern symmetric cipher takes 1-10 cycles per byte to encrypt an arbitrary length message while an assymetric algorithm takes hunders of thousands of cycles to encrypt a single small constant length message. $\endgroup$
    – orlp
    Sep 3, 2013 at 11:30
  • 1
    $\begingroup$ Minor nit: asymmetric encryption algorithms are nondetermanistic (even RSA, which uses random padding), and hence encrypting the same message twice yields distinct messages. This doesn't change your main point. $\endgroup$
    – poncho
    Sep 3, 2013 at 11:57
  • $\begingroup$ Minor nit nit: RSA doesn't specify any padding schema. That's why we have PKCS#1. It provides RSASSA-PSS (Probabilistic Signature Scheme) and RSAES-OAEP (Optimal Asymmetric Encryption Scheme). Crypto newbies often make the mistake to create their own padding schema. $\endgroup$
    – Christian Heimes
    Sep 3, 2013 at 13:29
4
$\begingroup$

KEM/DEM hybrid encryption has another advantage. It enables a very efficient multi-recipient encryption. The payload is encrypted and transmitted only one time.

Haven't you wondered yet why you are able to decrypt and read your own message although it was encrypted with the recipient's public key? Normally PGP encrypts the message key for symmetric encryption public keys of the recipient and your own public key. That way the message is encrypted just once. An additional recipient increases the size of the message by just a couple of bytes -- IIRC far less than 100 bytes.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ +1 multi-recipient encryption is a big point with email. $\endgroup$
    – Xeoncross
    Sep 3, 2013 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.