0
$\begingroup$

Before starting the question, I know that RSA is naturally a key exchange cryptosystem rather than an antilogarithm fully implemented for encrypting and decrypting data since the length of the secret data relies on the key size of RSA. Now, we know that RSA is asymmetric means it has a public key and a private key.I know that one should not be able to decrypt an encrypted key using RSA by the public key while the secret is decryptable by the private key. I've also read that (may be I'm confused and mistaken) the public key is calculated based on the private key.

Now I have some questions, when using this algorithm in C# using the cryptography namespace, we have to serialize and export the private members of the key (private key) to be able to decrypt the secret. So what is the purpose of the public key, how is it public at all, and how does it introduce a higher level of security to the algorithm.

Let's say I do the same using AES, then I'm gonna have two Keys (Key, IV) which are only shorter in size. Except for the length of key, how RSA is more secure than AES then. If I don't exchange the public key, what is the purpose of it, if I do but nobody can use it to break the secret then what is the purpose of it again?

$\endgroup$
  • 1
    $\begingroup$ Comparing RSA to AES in terms of security is like comparing apples and oranges. They have very different benefits and use cases and are often used in conjunction, not as competitors. $\endgroup$ – mikeazo Jan 26 '15 at 13:59
  • $\begingroup$ @mikeazo: No I don't do this, I wanna know the concept behind public - private keys. The AES example is just to question the behavior of RSA. $\endgroup$ – Dev Arc Jan 26 '15 at 14:02
  • 1
    $\begingroup$ You state in your question "how RSA is more secure than AES then". Sounds to me like you are asking for a comparison. If that is not your intent, I suggest you clarify the question. $\endgroup$ – mikeazo Jan 26 '15 at 14:05
  • $\begingroup$ @mikeazo: I mean what is purpose of the public key. Imagine we don't know about the mechanism of these two algorithms and we are looking at them from the perspective of someone who does not know what public key or symmetric cryptography is. If telling that person the public key is not useful for breaking the secret, we will be asked then why is it used at all? do you get what I mean? $\endgroup$ – Dev Arc Jan 26 '15 at 14:08
  • 1
    $\begingroup$ As far as key length, longer key length for RSA is because it's much weaker than AES with comparable key length. A 2048-bit RSA key is significantly weaker than a 128-bit AES key (it provides about the security of a 112 bit symmetric key; it takes 3072 bit RSA keys to equal 128 bit symmetric keys). $\endgroup$ – cpast Jan 27 '15 at 1:43
2
$\begingroup$

With regards to the public vs private keys, in RSA, the public key is used to encrypt information, the private key is used to decrypt it. Given only the public key, all you can do is encrypt. So, you can publish that online somewhere (key distribution is a very different problem). Anyone can use it to encrypt a message to you and only you can decrypt it.

Think of it this way. You give your friend a padlock and a wooden box. The padlock is unlocked. Your friend can put anything they want in the wooden box, put the padlock on, and lock the padlock. Now, only you, who knows the combination, can get at whatever was place in the box. In this example, the padlock is the public key, the combination is the private key. Having possession of the padlock (the public key) should not easily reveal the combination (the private key).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.