Is it necessary to generate a private key for each encryption process?

Question

I read about Asymmetric key cryptography like EG-ECC , RSA, ECDH. I understand the concept of mathematics to these algorithms. But I have wondered about the public key for sender and private key for recipient. In other words,

Any other user who wants to send an encrypted message can get the intended recipient's public key from a public directory. They use this key to encrypt the message, and they send it to the recipient. When the recipient gets the message, they decrypt it with their private key, How much is the length of the message here is it necessary to have the message length smaller or equal to the length of the public key or the message can be any length of random words, can be divided into more than one block in this case we will use the sender's public key more than one time. Is the process of generating keys occur in the process of block encryption or message (size greater than size key) encryption?

Answer 1

As you have correctly identified, there is a problem that with public key encryption you cannot encode long messages in an efficient way. Your message must be an element of a finite group and may therefore not exceed a certain number of bits.

Therefore often a hybrid approach with symmetric and asymmetric encryption is used. That is:

1. The sender encrypts his long message using a symmetric algorithm, using a randomly chosen secret key K.
2. The sender encrypts the secret key K using the public key of the recipient.
3. The sender sends the symmetrically encoded message and the asymmetrically encoded key K to the recipient.
4. The recipient first recovers K and then decrypts the long message.

Answer 2

RSA key pair generation is generally only performed once. A new RSA key pair only need to be generated when the old pair is revoked. Such a key pair can be used to encrypt/decrypt a lot of messages.

The RSA public and private key are linked; it is not possible to generate new private keys that use the same public key. Since you need to trust the public key, it is not useful to generate new key pairs either.

Now "textbook" RSA (just modular exponentiation) is of course limited by the value of the modulus; larger messages cannot be encrypted. However, RSA is only secure if a padding mode such as RSA or OAEP is used, this decreases the possible message size.

If you would simply split the messages in plaintext blocks and encrypted them, then the blocks can simply be switched or repeated by an attacker. So ECB mode RSA, as this would be called, is not secure.

Hybrid encryption is used instead. With hybrid encryption one or more session keys are agreed upon by both parties. One of these session keys can then be used to encrypt the messages. The session key establishment may simply be the RSA encryption of a secret key value, or it may be more involved (Ephemeral Diffie-Hellman with RSA authentication, for instance).

It is of course possible to define a CBC or Counter mode using RSA. It's just completely impractical, as RSA is neither efficient due to the large overhead (the padding) and the time it takes to do RSA (private key) calculations.